Search

The stateful property of Session Initiation Protocol (SIP) is exploited to cause a massive disruption to the SIP service. Existing SIP-Denial of Service defense mechanisms fail to detect low-rate floods, and consume higher detection time. We have generated SIP traffic in our laboratory and the performance of the classifiers was empirically evaluated. From the experimental results, it is evident that Support Vector Machine (SVM) performed fairly well compared to the other classifiers, but resulted in some false positives and false negatives. Our proposed SVMBoost algorithm which uses the dual cost formulation of SVM and Neyman–Pearson approach was experimented on both high-rate and low-rate message flooding data sets. SVMBoost classification algorithm achieves high detection accuracy of 99.9% with 0% false positive rate and with 0.27% false negative rate. SVMBoost outperforms the existing algorithms with a maximum gain of 35.97% and a minimum gain of 0.28% in high-rate flooding detection and with a gain of 4.45% in low-rate flooding detection. [ABSTRACT FROM AUTHOR]

Efficient detection of network attacks necessitates the identification of important features, capable of characterizing the attacks. Most of the feature selection techniques are based either on a particular measure or on a particular learning algorithm. As the features selected by each such feature selection technique are different, use of a particular feature selection technique is not enough to assess the importance of a feature. This motivated us to propose a multi-measure multi-weight feature identification approach which combines the filter and wrapper feature selection methods and clustering methods to assign multiple weights to each feature. Two novel weight assignment algorithms for wrapper and clustering method have been proposed to assign weights to each feature. Experiments performed with top weighted features of 10% KDD Cup 99 intrusion detection dataset shows the identified features are indeed important in detecting DoS and probe attacks. Also, the comparison of the proposed approach with the existing algorithms shows that the features identified by the proposed approach detects the attacks with higher accuracy. [ABSTRACT FROM AUTHOR]