Classification of DDoS attacks using self-organizing maps (SOM)

In this thesis, classification of DDoS attacks using Self Organizing Maps (SOM) is studied. Using OMNeT++ network simulation engine and INET network simulation library, a DDoS attack network is simulated and during this attack, generated packets are recorded. Using these packets, source port, destination port, payload length, and window size parameters of IP headers, and TCP headers are selected. For each packet, an input vector is created using these parameters. These input vectors have been classified using a self organizing map. Resulting network of SOM has been clustered using LVQ3 algorithm. Using the results, implementation of the developed technique is discussed. Keywords: Self Organizing Map, LVQ3, DDoS, OMNeT++, INET, TFN2K,