Online Distributed Denial of Service (DDoS) intrusion detection based on adaptive sliding window and morphological fractal dimension

Distributed Denial of Service (DDOS) attacks are important threats to network services and applications. Studies in literature have proposed various approaches including Intrusion Detection Systems (IDS) based on the application of machine learning and deep learning, but their computational cost can be significant. For this reason, other studies have proposed efficient IDS algorithms based on the online real-time analysis of the network traffic with a sliding window and entropy or other statistical measures. This paper proposes an online algorithm based on a sliding window with the novel application of the Morphological Fractal Dimension (MFD) to this problem. The results presented in this study show that the application of MFD to the recent CICIDS2017 public data set can obtain a significant improvement in the detection of the DDoS attack in comparison to entropy based approaches. In addition, this paper proposes a novel algorithm for the automatic definition of the sliding window size. This paper reports the impact of the different hyper-parameters, including the parameters present in the definition of MFD and the evaluation of the distance measures, where the Chebyschev distance provides the optimal detection accuracy. The results show a detection accuracy of 99.30%, which performs better than similar approaches on the same data set.