A new network flow grouping method for preventing periodic shrew DDoS attacks in cloud computing

摘要

Based on the investigation of periodic shrew distributed DoS Attacks among enormous normal end-users' flow in cloud computing, this paper proposed a new method to take frequency-domain characteristics from the autocorrelation sequence of network flow as clustering feature to group end-user flow data by BIRTH algorithm, and re-merge these clustering results into new groups by overcoming the deficiency of BIRTH algorithm. At last, the result of simulation proves the proposed method distinguishes abnormal network flows with higher detection accuracy and faster response time, and prevents abnormal network flow groups with less impaction.