Paket karakterleri ile DDoS atak tespiti

DDoS attacks have been in internet life for a long time and most of hosts are still vulnerable for DDoS attacks. Complete detection and prevention of DDoS attacks is almost impossible, since their working method. Especially, if you are observing a network, not only one host, detecting DDoS attack can be much harder. To detect DDoS attacks existence, we used 11 features. We first used only threshold value of each features to detect DDoS attacks. Then, we used RMS (Root Mean Square) to improve our detection rates. We found different features are the best for Syn flood attack detection and UDP Flood attack detection. The hardest issue for working on DDoS attacks is lack of publicly available datasets. We used UCLA dataset (University of California, Los Angeles), NUST datasets (National University of Sciences and Technology) and we composed 2 more datasets in Bogazici University to work on. In total, we applied our methods on 5 different datasets from 3 different institutes. Then, we compared our results with other similar studies. Our analysis showed that the best feature to detect TCP Syn flood attack is "SYN/ACK ratio" and the best feature to detect UDP flood is "flow generating rate".