The Early Detection of DDoS Based on the Persistent Increment Feature of the Traffic Volume

One of the major threats to cyber security is Distributed Denial of Service (DDoS) attacks. This paper proposes a new algorithm based on the persistent increment tendency of DDoS traffic. The scheme can detect a DDoS attack in its early stages when the attacking packet's attribute value has no distinct features. It can differentiate DDoS from flash crowd traffic. This scheme detects DDoS attacks with on-line and distributed characteristics. Simulation shows the algorithm's validity and accuracy.