earticle

영어

This paper deals with detecting an anomalous traffic area based on its distribution and distance measurements. On detecting anomalous traffic such as flooding attack traffic we should consider the packet attribute of the traffic. In order to identify that traffic, we compute entropy of selected packet attribute and Mahalanobis distance between normal and abnormal traffics. Chi-square test is used to evaluate the proposed method. Detection accuracy and performance are analyzed using real network traffic trace which consists the mostly backscatter of SYN flooding attack from LANDER project. The result of our proposed method indicates that it can show and offer significantly an accurate result.