Proposal of a DDoS Attack Detection Method Using the Communication Interval

As the scale of Distributed Denial of Service (DDoS) attacks has been escalating in recent years, the need for real-time detection of attacks has increased. Existing intrusion detection systems (IDSs) perform detection with a fixed window size (assumed to be in hours). In previous research, attack detection was performed by preparing windows of multiple sizes, selecting the appropriate window based on the state of the data, and using features learned in advance for that window size. Although this method yielded a high DDoS attack detection rate of 98.30%, it exhibited a considerable false-positive rate of 7.37%. The proposed method measures the communication intervals of identical packets within the window, identified as attack-related in the previous survey, and classifies those packets with an average communication interval below a set threshold as attacks. The experiment resulted in a 50.2% decrease in the false-positive rate.