Real time DDoS detection using fuzzy estimators

Stavros N. Shiaeles, Vasilios Katos*, Alexandros S. Karakos, Basil K. Papadopoulos

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review


We propose a method for DDoS detection by constructing a fuzzy estimator on the mean packet inter arrival times. We divided the problem into two challenges, the first being the actual detection of the DDoS event taking place and the second being the identification of the offending IP addresses. We have imposed strict real time constraints for the first challenge and more relaxed constraints for the identification of addresses. Through empirical evaluation we confirmed that the detection can be completed within improved real time limits and that by using fuzzy estimators instead of crisp statistical descriptors we can avoid the shortcomings posed by assumptions on the model distribution of the traffic. In addition we managed to obtain results under a 3 sec detection window.

Original languageEnglish
Pages (from-to)782-790
Number of pages9
JournalComputers and Security
Issue number6
Publication statusPublished - 1 Sept 2012


  • α-cuts
  • Anomaly based intrusion detection
  • Distributed denial-of-service attacks
  • Fuzzy estimators
  • Poisson arrival


Dive into the research topics of 'Real time DDoS detection using fuzzy estimators'. Together they form a unique fingerprint.

Cite this