Likelihood ratios and recurrent random neural networks in detection of Denial of Service attacks

In a world that is becoming increasingly dependent on Internet communication, Denial of Service (DoS) attacks have evolved into a major security threat which is easy to launch but difficult to defend against. In order for DoS countermeasures to be effective, the attack must be detected early and accurately. In this paper we propose a DoS detection technique based on observation of the incoming traffic and a combination of traditional likelihood estimation with a recurrent random neural network (r-RNN) structure. We select input features that describe essential information on the incoming traffic and evaluate the likelihood ratios for each input, to fuse them with a r-RNN. We evaluate the performance of our method in terms of false alarm and correct detection rates with experiments on a large networking testbed, for a variety of input traffic.