Low-Rate DDoS Attack Detection Using Expectation of Packet Size

Algorithm 1

Low-rate DDoS attack detection using the expectation of packet size.

Input:

 Sample time ;

 Tolerance factor ;

 Obtained .

Output:

 Low-rate DDoS attack indicator .

() According to sample time , sample packets;

() Cluster packets by network flow;

() Determine the statistics of the packet size and calculate the mean packet size of each flow;

() Calculate the probabilities of network flows;

() Calculate the expectation of packet size and variance ;

() According to formula (10), set ;

() return