Abstract
Neptune attack and Flash Crowd are two typical threats to web servers. These two anomalies have many identical features that make them difficult to distinguish. In this paper, we propose a statistical packet-based method to detect Neptune attacks and Flash Crowds and more importantly, by performing separate analysis by source address aggregation, we also propose additional efficient means to differentiate these two similar anomalies.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Jung, J., Krishnamurthy, B., Rabinovich, M.: Flash Crowds and Denial of Service Attacks: Characterization and Implications for CDNs and Web Sites. In: Proc. Int’l World Wide Web Conference, pp. 252–262. ACM Press, New York (2002)
ClarkNet and NASA Web server logs are available on the Internet Traffic Archive, http://ita.ee.lbl.gov/html/traces.html
Author information
Authors and Affiliations
Editor information
Rights and permissions
Copyright information
© 2007 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Le, T.Q., Zhanikeev, M., Tanaka, Y. (2007). Detection and Identification of Neptune Attacks and Flash Crowds. In: Ata, S., Hong, C.S. (eds) Managing Next Generation Networks and Services. APNOMS 2007. Lecture Notes in Computer Science, vol 4773. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-75476-3_68
Download citation
DOI: https://doi.org/10.1007/978-3-540-75476-3_68
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-75475-6
Online ISBN: 978-3-540-75476-3
eBook Packages: Computer ScienceComputer Science (R0)