Group testing based detection of web service DDoS attackers

Dalia Nashat, Xiaohong Jiang, Michitaka Kameyama

Research output: Contribution to journalArticlepeer-review

4 Citations (Scopus)


The Distributed Denial of Service attack (DDoS) is one of the major threats to network security that exhausts network bandwidth and resources. Recently, an efficient approach live Baiting was proposed for detecting the identities of DDoS attackers in web service using low state overhead without requiring either the models of legitimate requests nor anomalous behavior. However, Live Baiting has two limitations. First, the detection algorithm adopted in Live Baiting starts with a suspects list containing all clients, which leads to a high false positive probability especially for large web service with a huge number of clients. Second, Live Baiting adopts a fixed threshold based on the expected number of requests in each bucket during the detection interval without the consideration of daily and weekly traffic variations. In order to address the above limitations, we first distinguish the clients activities (Active and Non-Active clients during the detection interval) in the detection process and then further propose a new adaptive threshold based on the Change Point Detection method, such that we can improve the false positive probability and avoid the dependence of detection on sites and access patterns. Extensive trace-driven simulation has been conducted on real Web trace to demonstrate the detection efficiency of the proposed scheme in comparison with the Live Baiting detection scheme.

Original languageEnglish
Pages (from-to)1113-1121
Number of pages9
JournalIEICE Transactions on Communications
Issue number5
Publication statusPublished - 2010


  • Change point detection
  • Distributed denial of service
  • Group-testing
  • Intrusion detection

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications
  • Electrical and Electronic Engineering


Dive into the research topics of 'Group testing based detection of web service DDoS attackers'. Together they form a unique fingerprint.

Cite this