A cascade architecture for DoS attacks detection based on the wavelet transform

摘要: In this paper we propose an automated system able to detect volume-based anomalies in network traffic caused by Denial of Service (DoS) attacks. We designed a with two-stage architecture that combines more traditional change point detection approaches (Adaptive Threshold and Cumulative Sum) novel one based on the Continuous Wavelet Transform. The presented anomaly is achieve good results terms trade-off between correct detections false alarms, estimation duration, ability distinguish subsequent anomalies. test our using set publicly available attack-free traces which superimpose profiles obtained both as time series known common behaviors generating real tools for DoS Extensive show how proposed accurately detects wide range performance indicators are affected characteristics (i.e. amplitude duration). Moreover, separately consider evaluate some special test-cases.