[Paper Review] Early Signals from Volumetric DDoS Attacks: An Empirical Study

Michele Nogueira, Augusto Santos+1 more|arXiv (Cornell University)|Sep 30, 2016

Network Security and Intrusion Detection15 references3 citations

TL;DR

This paper proposes using non-parametric leading indicators—return rate, autocorrelation, coefficient of variation, and skewness—to predict volumetric DDoS attack trends before they begin. Analyzing real CAIDA dataset traces, it demonstrates these indicators exhibit critical transition behaviors up to 22 minutes prior to attack onset, enabling early warning of disruptive network changes.

ABSTRACT

Distributed Denial of Service (DDoS) is a common type of Cybercrime. It can strongly damage a company reputation and increase its costs. Attackers improve continuously their strategies. They doubled the amount of unleashed communication requests in volume, size, and frequency in the last few years. This occurs against different hosts, causing resource exhaustion. Previous studies focused on detecting or mitigating ongoing DDoS attacks. Yet, addressing DDoS attacks when they are already in place may be too late. In this article, we consider network resilience by early prediction of attack trends. We show empirically the advantage of using non-parametric leading indicators for early prediction of volumetric DDoS attacks. We report promising results over a real dataset from CAIDA. Our results raise new questions and opportunities for further research in early predicting trends of DDoS attacks.

Motivation & Objective

• To address the limitation of existing DDoS detection and mitigation systems that react only after attacks begin.
• To explore whether non-parametric leading indicators can predict the onset of volumetric DDoS attacks before they occur.
• To empirically validate the presence of metastability-related behaviors in network traffic prior to disruptive DDoS events.
• To provide a foundation for proactive defense mechanisms by identifying generic, early-warning signatures of attack trends.

Proposed method

• Extracted time series of packet sizes from tcpdump traces of the CAIDA UCSD DDoS 2007 dataset, focusing on attack and preparation phases.
• Calculated four non-parametric leading indicators: return rate, lag-1 autocorrelation, coefficient of variation, and skewness over sliding windows of time series data.
• Analyzed temporal changes in these indicators to detect characteristic behaviors associated with critical transitions in network state.
• Identified patterns consistent with metastability—decreasing return rate and increasing autocorrelation, variance, and skewness—before attack onset.
• Used empirical analysis to compare indicator behavior during preparation, attack, and post-attack phases.
• Evaluated the timing of these behavioral shifts relative to the actual attack launch time to assess early prediction potential.

Experimental results

Research questions

• RQ1 Can leading indicators derived from network traffic time series detect early signs of an impending volumetric DDoS attack?
• RQ2 Do the characteristic behaviors of metastability—such as decreasing return rate and increasing autocorrelation—emerge before the attack begins?
• RQ3 How early can these indicators signal the onset of a disruptive network transition due to a DDoS attack?
• RQ4 Are these indicators effective in the preparation phase, before the attack is fully launched?
• RQ5 Can these generic indicators serve as a foundation for proactive DDoS early warning systems?

Key findings

• The leading indicators—return rate, autocorrelation, coefficient of variation, and skewness—exhibited the characteristic behavior of a critical transition 22 minutes before the DDoS attack began.
• A significant decrease in return rate and increases in autocorrelation, coefficient of variation, and skewness were observed at 20:51 and 20:52, during the attack preparation phase.
• These behavioral shifts were not present at the exact attack kickoff time, indicating that the warning signs emerge in the lead-up phase.
• The study confirms that metastability-related patterns in network traffic can be detected before disruptive DDoS events occur.
• The indicators showed consistent and detectable changes in the preparation phase, suggesting their potential for early prediction.
• The results suggest that non-parametric, generic indicators can serve as reliable early warning signals for volumetric DDoS attacks.