Detecting and tracing DDoS attacks in the traffic analysis using auto regressive model

Yuichi Uchiyama, Yuji Waizumi, Nei Kato, Yoshiaki Nemoto

Research output: Contribution to journalArticlepeer-review

8 Citations (Scopus)


In recent years, interruption of services large-scale business sites and Root Name Servers caused by Denial-of-Service (DoS) attacks or Distributed DoS (DDoS) attacks has become an issue. Techniques for specifying attackers are, thus important. On the other hand, since information on attackers' source IP addresses are generally spoofed, tracing techniques are required for DoS attacks. In this paper, we predict network traffic volume at observation points on the network, and detect DoS attacks by carefully examining the difference between predicted traffic volume and actual traffic volume. Moreover, we assume that the duration time of an attack is the same at every observation point the attack traffic passes, and propose a tracing method that uses attack duration time as a parameter. We show that our proposed method is effective in tracing DDoS attacks.

Original languageEnglish
Pages (from-to)2635-2643
Number of pages9
JournalIEICE Transactions on Information and Systems
Issue number12
Publication statusPublished - 2004 Dec


  • Attack duration time
  • Auto regressive model
  • DDoS
  • Detection
  • DoS
  • Tracing


Dive into the research topics of 'Detecting and tracing DDoS attacks in the traffic analysis using auto regressive model'. Together they form a unique fingerprint.

Cite this