Adaptive Polling Rate for SNMP for Detecting Elusive DDOS  

作　　者：Yichiet Aun Yen-Min Jasmina Khaw Ming-Lee Gan Vasaki Ponnusamy 

机构地区：[1]Faculty of Information Communication and Technology,Kampar,31900,Malaysia

出　　处：《Journal of Cyber Security》2022年第1期17-28,共12页网络安全杂志（英文）

摘　　要：Resilient network infrastructure is pivotal for business entities that are growing reliance on the Internet.Distributed Denial-of-Service(DDOS)is a common network threat that collectively overwhelms and exhausts network resources using coordinated botnets to interrupt access to network services,devices,and resources.IDS is typically deployed to detect DDOS based on Snort rules.Although being fairly accurate,IDS operates on a computeintensive packet inspection technique and lacks rapidDDOSdetection.Meanwhile,SNMP is a comparably lightweight countermeasure for fast detection.However,this SNMP trigger is often circumvented if the DDOS burst rate is coordinated to flood the network smaller than theSNMPpolling rate.Besides,SNMP does not scale well if the poll rate is set extremely fine for improved detection accuracy.In this paper,a lightweight 3D SNMP scaling method is proposed to optimize the SNMP poll rate forDDOSmitigation automatically.The 3D-SNMP uses horizontal scaling to dynamically adjust the optimal poll rate through random packet inspection that is selective.Suppose a sign of DDOS is detected,3D-SNMP scales down the poll rate for finer detection.As DDOS subsides,3D-SNMP scales the poll rate up for faster DDOS detection.The equilibrium between scalability and accuracy is determined on the fly depending on the types of DDOS variants.3D-SNMP also adds a vertical scaling to detect non-salient DDOS that falls below the detection threshold.The experimental results showed that 3D-SNMP achieved DDOS detection of 92%while remaining scalable to different DDOS variants and volumes.

关 键 词：SNMP DDOS poll rate network security threat detection 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]