engleski

Analysing the influence of the DCBF data structure on the DoS attack detection

Distributed Denial of Service attacks present a serious threat to Internet security. There is a great effort in research that focuses on the detection of the DoS attack. The most common DoS attack detection method rely on the number of the TCP control packet in the network flow. The Bloom filter represents a space-efficient data structure that is commonly used to detect matching pairs. There are multiple algorithms for the DoS attack detection based on the Bloom filter. The SACK2 algorithm uses the SYN/ACK - ACK matching pair detection with the Bloom filter data structure. The false positive error introduced by the Bloom filter influences on the matching pair detection in the algorithm. The improved SACK2 algorithm significantly reduces the false positive error by replacing the Counting Bloom Filter (CBF) data structure with the Dual Counting Bloom Filter (DCBF) data structure. This improvement significantly improves the matching pair detection. It is expected that the false positive error should influence on the detection of the DoS attack. In this paper, the experimental study is performed to analyse this influence. This study confirms the correlation between the false positive error and the DoS attack detection.

DoS, Bloom filter, DCBF, False positive error

nije evidentirano