Skip to Main content Skip to Navigation
Journal articles

Evaluating the Impact of Traffic Sampling on AATAC's DDoS Detection

Gilles Roudiere 1 Philippe Owezarski 1
1 LAAS-SARA - Équipe Services et Architectures pour Réseaux Avancés
LAAS - Laboratoire d'analyse et d'architecture des systèmes
Abstract : As Distributed Denial of Service (DDoS) attack are still a severe threat for the Internet stakeholders, they should be detected with efficient tools meeting industrial requirements. We previously introduced the AATAC detector, which showed its ability to accurately detect DDoS attacks in real time on full traffic, while being able to cope with the several constraints due to an industrial operation, as time to detect, limited resources for running detection algorithms, detection autonomy for not wasting uselessly administrators' time. However, in a realistic scenario, network monitoring is done using sampled traffic. Such sampling may impact the detection accuracy or the pertinence of produced results. Consequently, in this paper, we evaluate AATAC over sampled traffic. We use five different count-based or time-based sampling techniques, and show that AATAC's resources consumption is in general greatly reduced with little to no impact on the detection accuracy. Obtained results are succinctly compared with those from FastNetMon, an open-source threshold-based DDoS detector.
Document type :
Journal articles
Complete list of metadata

Cited literature [21 references]  Display  Hide  Download
Contributor : Philippe Owezarski <>
Submitted on : Friday, October 25, 2019 - 9:04:50 PM
Last modification on : Thursday, June 10, 2021 - 3:01:31 AM
Long-term archiving on: : Sunday, January 26, 2020 - 12:11:20 PM


Files produced by the author(s)



Gilles Roudiere, Philippe Owezarski. Evaluating the Impact of Traffic Sampling on AATAC's DDoS Detection. Journal of Cyber Security and Mobility, River Publishers, 2019, 8 (4), pp.419-438. ⟨10.13052/jcsm2245-1439.842⟩. ⟨hal-02047267⟩



Record views


Files downloads