Self-organizing maps for early detection of denial of service attacks

Abstract

Detection and early alert of Denial of Service (DoS) attacks are very important actions to make appropriate decisions in order to minimize their negative impact. DoS attacks have been catalogued as of high-catastrophic index and hard to defend against. Our study presents advances in the area of computer security against DoS attacks. In this chapter, a flexible method is presented, capable of effectively tackling and overcoming the challenge of DoS (and distributed DoS) attacks using a CISDAD (Computer Intelligent System for DoS Attacks Detection). It is a hybrid intelligent system with a modular structure: a pre-processing module (non neural) and a processing module based on Kohonen Self-Organizing artificial neural networks. The proposed system introduces an automatic differential detection of several Normal Traffic and several Toxic Traffics, clustering them upon its Transport-Layer-Protocol behavior. Two computational studies of CISDAD working with real networking traffic will be described, showing a high level of effectiveness in the CISDAD detection process. Finally, in this chapter, the possibility for specific adaptation to the Healthcare environment that CISDAD can offer is introduced.