Man-machine Cooperative Monitoring System to Support Detection of DoS/DDoS Attacks Through Continuous SOM Diagram Generation

DoS/DDoS attacks on the Internet target various organizations and government agencies. Because DoS/DDoS attacks disguise themselves as legitimate communication, they are difficult to detect with high precision. In actual networks, network administrator detection DoS/DDoS attacks are based on thresh-olds for the number of DoS events, blacklists of DoS sources, and server conditions. However, automation and mechanization are difficult, and manual detection by administrators is inadequate. In this study, we developed a system to assist administrators in detecting DoS/DDoS attacks using a self-organizing map (SOM) neural network. The system continuously acquires traffic data from security devices and automatically generates SOM diagrams. In addition, the system generates traffic data known as an attack in advance and inserts them into the legitimate traffic data, thereby facilitating the judgment of attacks by administrators. Administrators analyzed DoS/DDoS attacks using this system over two months. As a result of analyzing 202 SOM diagrams generated periodically, the administrator was able to classify 65 abnormal SOMs diagrams into three types of abnormal states. Moreover, for 10 of the 65 SOMs, we could assist in identifying DoS/DDoS attacks. This paper describes the continuous acquisition of traffic data, insertion of pseudo-attacks, automatic generation of SOM diagrams, and administrator decision support and judgment,