Portal de Periódicos da CAPES

Use of Tsallis entropy in detection of SYN flood DoS attacks

2015; Hindawi Publishing Corporation; Volume: 8; Issue: 18 Linguagem: Inglês

10.1002/sec.1286

1939-0114

Ilija Bašičević, Stanislav Očovaj, Miroslav Popović,

Statistical Mechanics and Entropy

Abstract In this paper, we present results of application of Tsallis entropy in detection of denial of service attacks. Two detectors, one based on Tsallis and the other one based on Shannon's entropy, have been applied in several attack simulations, and their properties have been compared. The simulated attack is Synchronize packet (SYN) flood. A simple packet distribution, that is, entropy of source addresses are considered. In both cases, cumulative sum control chart algorithm is used for change point detection. Properties of two detectors that are compared are detection delay and rate of true and false positives. The results show that Tsallis entropy‐based detector can outperform (with respect to false positive rate) Shannon‐based one but that requires careful tuning of Tsallis Q parameter that depends on characteristics of network traffic. The detection delay of two detectors is approximately the same. Copyright © 2015 John Wiley & Sons, Ltd.