The Computer Journal Advance Access originally published online on September 25, 2007
The Computer Journal 2007 50(6):717-727; doi:10.1093/comjnl/bxm066
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
A Denial of Service Detector based on Maximum Likelihood Detection and the Random Neural Network
Electrical and Electronic Engineering, Imperial College, Exhibition Road, London, SW7 2BT, UK
* Corresponding author: g.oke{at}imperial.ac.uk
Received 15 May 2007; revised 15 May 2007
Due to the simplicity of the concept and the availability of attack tools, launching a DoS attack is relatively easy, while defending a network resource against it is disproportionately difficult. The first step of a protection scheme against DoS must be the detection of its existence, ideally before the destructive traffic build-up. In this paper we propose a DoS detection approach which uses the maximum likelihood criterion with the random neural network (RNN). Our method is based on measuring various instantaneous and statistical variables describing the incoming network traffic, acquiring a likelihood estimation and fusing the information gathered from the individual input features using likelihood averaging and different architectures of RNNs. We present and compare seven variations of it and evaluate our experimental results obtained in a large networking testbed.
Key Words: denial of service • random neural networks • network security • intrusion detection • maximum likelihood detection criterion