Detecting Distributed DoS/Scanning by Anomaly Distribution of Packet Fields

Abstract

To detect distributed denial of service and distributed scanning attacks, we propose Anomaly Dispersion Scheme (ADS). Observing the creation of packet fields in attack programs and normal programs, ADS monitors the distributions of packet fields, which alter when the attack programs using raw socket interface partake in, to detect intrusion. The sets of anomaly packet fields are attack signatures.