BUET-DDoS2020

Distributed Denial of Service (DDoS) is one of the most frequent attacks in cloud that cause significant damage, affect the performance and continue to be the predominant security challenge. Over the past decade, research on DDoS attack detection has focused on a few classes of these attacks. To generate DDoS flooding attack we use three tools namely: hping3, mausezahn and wreckuests. UDP flood attack, TCP SYN flood attack and ICMP flood attack was performed by using hping3. For DNS flood attack mausezahn was used and for HTTP Flood attack wreckuests was used. Tcpdump, a traffic protocol analyzer is used to capture the attack traffic. Moreover, legitimate traffic was also collected using tcpdump from Lab environment network. The captured attack traffic and normal traffic were used to create a new dataset. The dataset has six classes and 1081633 records out of which 1001984 are DDoS attacks. Distribution of Different Classes. Types No. of Records TCP SYN flood attack 551179 ICMP flood attack 136496 UDP flood attack 125774 DNS flood attack 114160 HTTP flood attack 74375 Legitimate traffic 79649分布式拒绝服务（Distributed Denial of Service, DDoS）攻击是云计算环境中最为频发的攻击类型之一，不仅会造成严重损害、影响系统性能，且至今仍是主流的网络安全挑战。 近十年来，针对DDoS攻击检测的相关研究大多仅聚焦于少数几类攻击场景。 为生成DDoS泛洪攻击流量，本次实验采用三款工具，分别为hping3、mausezahn与wreckuests：使用hping3实施UDP泛洪、TCP SYN泛洪及ICMP泛洪三类攻击；使用mausezahn实施DNS泛洪攻击；使用wreckuests实施HTTP泛洪攻击。 本研究借助流量协议分析工具Tcpdump捕获攻击流量，同时从实验室网络环境中采集合法流量，最终将捕获的攻击流量与正常流量整合，构建得到全新的数据集。该数据集共包含6个类别，总计1081633条记录，其中1001984条为DDoS攻击流量。 各类别样本分布如下： | 攻击类型 | 样本数量 | |-------------------------|----------| | TCP SYN泛洪攻击 | 551179 | | ICMP泛洪攻击 | 136496 | | UDP泛洪攻击 | 125774 | | DNS泛洪攻击 | 114160 | | HTTP泛洪攻击 | 74375 | | 合法流量 | 79649 |