\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={DoS and DDoS Attacks: Defense, Detection and Traceback Mechanisms -A Survey},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2014-01-15 (revised: 15 January 2014)}
\def\TheID{\makeatother }
\def\TheDate{2014-01-15}
\title{DoS and DDoS Attacks: Defense, Detection and Traceback Mechanisms -A Survey}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{K.Munivara  Prasad}

             \affil[1]{  JNTUH}

\renewcommand\Authands{ and }

\date{\small \em Received: 12 December 2013 Accepted: 3 January 2014 Published: 15 January 2014}

\maketitle


\begin{abstract}
        


 Denial of Service (DoS)  Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks are typically explicit attempts to exhaust victim?s bandwidth or disrupt legitimate users? access to services. Traditional architecture of internet is vulnerable to DDoS attacks and it provides an opportunity to an attacker to gain access to a large number of compromised computers by exploiting their vulnerabilities to set up attack networks or Botnets. Once attack network or Botnet has been set up, an attacker invokes a large-scale, coordinated attack against one or more targets. Asa result of the continuous evolution of new attacks and ever-increasing range of vulnerable hosts on the internet, many DDoS attack Detection, Prevention and Traceback mechanisms have been proposed, In this paper, we tend to surveyed different types of attacks and techniques of DDoS attacks and their countermeasures. The significance of this paper is that the coverage of many aspects of countering DDoS attacks including detection, defence and mitigation, traceback approaches, open issues and research challenges.

\end{abstract}


\keywords{denial of service (DoS), distributed denial of service (DDoS), detection mechanisms and trceback approaches.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
enial-of-service (DoS) attacks exploit internet to target critical Web services \hyperref[b0]{[1,}\hyperref[b1]{2,}\hyperref[b2]{3,}\hyperref[b3]{4,}\hyperref[b4]{5,}\hyperref[b5]{6]}. This type of attack is intended to prevent legitimate users from accessing a specific network resource or degrade normal services for legitimate users by sending huge unwanted traffic to the victim (machines or networks) to exhaust services and connection capacity or the bandwidth. Increasing flow of these DoS attacks has made servers and network devices on the internet at greater risk. Denial of service attack programs are around for several years. Previous single source attacks are currently countered simply by several defense mechanisms and therefore the source of those attacks will be simply rejected or blocked with improved tracing capabilities. However, with the amazing growth of the internet throughout the last decade, an increasingly large amount of vulnerable systems are currently available to attackers. Attackers will currently use a huge range of those vulnerable hosts to launch an attack rather than employing a single server, an approach that is not terribly effective and detected easily.\par
A distributed denial of service (DDoS) attack \hyperref[b6]{[7,}\hyperref[b11]{12]} is a large-scale, coordinated attack on the provision of services of a victim system or network resources, launched indirectly through a large number of compromised computer agents on the internet. Before applying an attack the attacker takes large number of computer machines under his control over the internet and these computers are vulnerable machines. The attacker exploits these computers weaknesses by inserting malicious code or some other hacking technique so that they become under his control. These vulnerable or compromised machines can be hundreds or thousands in numbers and these are commonly termed as 'zombies.' The group of zombies usually formed the 'botnet.  {\ref '} The magnitude of attack is depends on the size of botnet, for larger botnet, attack is more severe and disastrous.\par
DDoS attacks in the Internet can be launched using two main methods. In the first method the attacker send some malicious packets to the victim to confuse a protocol or an application running on it (i.e., vulnerability attack \hyperref[b7]{[8]}). The Second method essentially include the network/transport-level/ application-level flooding attacks \hyperref[b7]{[8]}, in which an attacker to do one or both of the following: (i) interrupt a legitimate user's connectivity by exhausting bandwidth, network resources or router processing capacity or (ii) disrupt services of a legitimate user's by exhausting the server resources such as CPU, memory, disk/database bandwidth and I/O bandwidth.\par
Nowadays, DDoS attacks are often launched through well organized, remotely controlled, and widely distributed Zombies or Botnet computers of a network, that are continuously or simultaneously sending a huge amount of traffic or service requests to the target system. The attack results the target system either responds so slowly, unusable or crashes completely \hyperref[b7]{[8]}, \hyperref[b8]{[9]}  \hyperref[b9]{[10]}. Zombies of a botnet are usually recruited through the use of Trojan horses, worms, or backdoors \hyperref[b10]{[11]}- \hyperref[b12]{[13]}. It is very difficult for the defense mechanisms to identify the original attacker because of the use of spoofed IP addresses by zombies under the control of the attacker with botnet \hyperref[b13]{[14]}.\par
Earlier DDoS attacks were manual, in which attacker had to implement many steps before the launch of final attack, which includes port scanning, identifying compromised machines or zombies in the internet to E create botnet, deploying malware etc. Nowadays, sophisticated and automated DoS or DDoS attack tools been developed to assist attackers in implementing all or some steps automatically with minimal human effort to launch these attacks. The attackers can just configure desired attack parameters for a specified attack and the rest is managed by automated tools. Some of the common automated attack tools available are TFN (Tribe Flood Network), Trinoo, TFN2K, Shaft, Stacheldraht, Knight and Trinity. Many of them work on IRC (Internet Relay Chat) in which handlers and zombies communicate indirectly without revealing their identities. The others are agent based where handlers and zombies know each other's identity and communicate direct \hyperref[b8]{[9]}.\par
II. 
\section[{DDoS Attacks Classification and Architectures a) DDoS Motivation}]{DDoS Attacks Classification and Architectures a) DDoS Motivation}\par
DDoS attackers are usually motivated by various reasons. We categorized these DDoS attacks based on the motivation of the attackers into seven main classes:\par
1. Financial/economical gain: Attacks launched for financial gain are often, the most dangerous and difficult to stop. These are mainly concern of corporations and require more technical skills and experience. 2. Invariably slow network performance: The attacker launches an attack to block the resources of victim system, which slowdowns the performance of the system and intern to the network. 3. Revenge: Attackers of this kind are normally with lower technical skills and are frustrated individuals, carry out these as a response to a perceived injustice. 4. Ideological belief: Attackers in this category are inspired by their ideological beliefs to attack their targets. This category is currently one of the major incentives for the attackers to launch DDoS attacks. 5. Intellectual Challenge: In this, attack the targeted systems for experiment and learn how to launch various attacks. They are usually young hacking enthusiasts who want to show off their competencies. 6. Service unavailability: In this attacker overloads the services offered by the victim system through unwanted or fake traffic. 7. Cyberwarfare: Attackers of this class is normally belong to the military or terrorist organizations of a country and they are politically motivated to attack a wide range of critical sections of another country. 
\section[{b) Classification}]{b) Classification}\par
Various classifications of DDoS attacks have been proposed in the literature, when DDoS attacks are classified based on the degree of automation, they are defined as Manual, Semi-automatic and Automatic attacks. In manual approach the attacker had to complete many steps before the launch of final attack, such as port scanning, identifying available machines in the public or private network to build botnet, inserting malware etc. For Semi-automatic or Automatic attacks, various sophisticated attack tools have been developed to support attackers in carrying out all or some steps automatically to reduce human effort. The attackers can configure desired attack parameters and the rest is done by automated tools.\par
Another classification of DDoS attacks by attack rate i.e., how the rate of attack varies with respect to the time. The classes are Continuous Rate and Variable Rate attacks. The attack has constant flow in continuous rate after it is executed. But as in, variable rate attack changes its impact and flow with time, making it more difficult to detect and respond. Within variable rate, the attack rate can further be applied as Fluctuating or Increasing. Additionally, based on the data rate of attack, traffic in a network is also categorized as high rate and low rate DDoS attacks. DDoS attacks further classified as 'by impact' i.e., in which the normal service is completely unavailable to users known as Disruptive, or it can be Degrading the services of victim system in which it is not completely unavailable or decrease in the efficiency.\par
In direct attacks, agents or zombie machines directly attack the victim system as shown in the in Figure  {\ref .} 1. But in reflector attacks, zombies send request packets to a number of other compromised machines (PCs, routers etc.) called Zombies or Bots and the reply generated Zombies is targeted towards the victim system for an impact desired by the attacker. Example for this attack is sending huge amount of traffic as 'ping' request with spoofed IP address to the victim system to saturate bandwidth.\par
The main classification of DDoS attacks is 'by exploited vulnerability' through which an attacker launches attack on the victim. The classification is given in Fig.  {\ref 2} .In this classification, flood attack is used to block the victim's machine or network's bandwidth. This can be performed as TCP flood, UDP flood and ICMP flood. In general, all flooding attacks generated through DDoS can as direct attacks or reflector attacks. zombies or bots that are controlled by an attacker (also called as bot Master) form a botnet. Botnets consist of masters, handlers, and bots as shown in Figure \hyperref[fig_3]{3}. The handlers are means of communication that attackers use to command and control indirectly the bots. The handlers can be programs installed by the attackers on a collection of compromised systems (e.g.,Network servers) to send commands to carry out the attack. Bots are devices that have been compromised by the handlers and that will carry out the attack on the victim's system. Figure  {\ref 4} shows all the elements of a botnet. The owners and users of the bot systems are generally unaware of the situation. 
\section[{ii. IRC-based architecture}]{ii. IRC-based architecture}\par
The bot master or controller launches an attack through the bots by sending the commands to them which intern behave according to the master instructions. At the other end the bot sends the response or the status information to the master. Their communication is done through public chat systems instead of doing these with their original addresses. If they use the original identity or private channels, the detection system easily track and block the location and system. Internet relay chat (IRC) is the one which allows the users to communicate without performing any authentication check and no security to user communications. IRC provides a text-based command syntax protocol to define the rules and regulations to the users and that is installed widely across the network. There is huge number of existing IRC networks available in the internet and which can be used as public exchange points, but the majority IRC networks doesn't contain any strong authentication. The wide variety of tools in the internet is available to provide anonymity on IRC networks. Therefore, IRC provides simple, lowlatency, widely available, and anonymous command and control channel for botnet communication. An IRC network is a collection of one or more IRC servers as depicted in figure  {\ref 4}. There are four steps in launching a DDoS attack. These are shown in Figure 5.\par
1. Discover vulnerable hosts or agents: The attacker selects the agents to perform the attack. Any systems which is running with no antivirus software or pirated copies of software in internet is vulnerable and operated as a compromised system. Attackers utilized these compromised hosts or bots for further scanning and compromises .Attacker generates the attack stream by using the abundant resources of these compromised machines.\par
2. Compromise: The attacker exploits vulnerabilities and security holes of the agent machines and installs the attack code.    When a DDoS attack is detected, there is nothing that can be done except manually fix the problem and disconnect the victim system from the network. DDoS attacks blocks a lot of resources such as CPU power, bandwidth, memory, processing time, etc., on the paths that lead to the targeted system. The main goal of any DDoS defense mechanism is to detect DDoS attacks as soon as possible and stop them as near as possible to their sources. DDoS defense schemes are divided into four classes based on the locality of deployment: source-end, victim-end, Coreend or intermediate router and Distributed or Hybrid defense mechanisms. The advantages and disadvantages of all these approaches are given in the table1.\par
i. Source-end defense mechanism Source-end defense mechanisms are deployed at the sources of the attack to prevent network users from generating DDoS attacks. In this approach, source devices identify malicious packets in outgoing traffic and filter or rate-limit the traffic. Detecting and stopping a DDoS attack at the source is the best possible defense as minimum damage is done on legitimate traffic.\par
ii. Victim-end defense mechanism In the victim-end defense mechanism, the victim system detects, filter or rate-limit malicious incoming traffic at the routers of victim networks, i.e., networks providing Web services. The legitimate and attack traffic can clearly be distinguished from either online or offline, using either misuse based intrusion detection or anomaly based intrusion detection. However, attack traffic reaching the victim may denied or degraded services and bandwidth saturation.\par
iii. Core-end or Intermediate router defense mechanism\par
In core-end or intermediate network defense scheme, any router in the network can independently attempt to identify the malicious traffic and filter or ratelimit the traffic. It also balances the trade-offs between detection accuracy and attack bandwidth consumption. Detection and traceback of attack sources becomes easy, due to collaborative operation. In this point of defense, the traffic is aggregated i.e., both attack and legitimate packets arrive at the router and it is a better place to rate-limit all the traffic. iv. Distributed-end or Hybrid Defense architecture Attack detection and mitigation at distributed ends can be the best strategy against DDoS attacks. The hybrid defense mechanisms are deployed at (or their components are distributed over) multiple locations such as source, Victim or intermediate networks and there is usually cooperation among the deployment points. The core-end is best to rate-limit all kinds of traffic whereas the victim-end can accurately detect the attack traffic in a combination of legitimate and attack packets. Therefore, distribution of methods of detection and mitigation at different ends of the network can be more beneficial. 
\section[{b) DDoS Detection and Mitigation Strategies}]{b) DDoS Detection and Mitigation Strategies}\par
In this section, we present a summary of existing methods on DDoS attack detection and mitigation. These methods are based on the architectures discussed above namely source-end, Victim-end, Core-end and Hybrid mechanisms in the network. We classify methods for DDoS attack detection into four major classes as shown in Figure 6. 
\section[{i. Statistical Methods}]{i. Statistical Methods}\par
Statistical properties of normal and attack patterns can be exploited for detection of DDoS attacks. Generally a statistical model for normal traffic is calculated and then a statistical inference test is applied to determine if a new instance of the traffic or flow belongs to this model. Instances that do not follow the learnt model, based on the applied test statistics results, traffic or flows are classified as anomalies.\par
Chen et al. \hyperref[b18]{[19]} develop a distributed change point (DCP) detection architecture using change aggregation trees (CATs). The pre-change and postchange network traffic was described using nonparametric CUSUM approach. The cumulative deviation is higher than random increase when a DDoS flooding attack is launched and CAT mechanism is designed to detect abrupt changes in traffic flows work at router level. The traffic change patterns were detected at the domain server uses attack-transit to construct the CATs, which represent the attack flow pattern. Saifullah \hyperref[b21]{[21]} proposes a defense mechanism by using distributed algorithm that performs weight-fair throttling at upstream routers. The throttling is weight-fair because the traffic intended for the server is controlled (increased or decreased) by using leaky buckets at the routers based on the number of users connected, directly or indirectly to the routers. In the beginning of the algorithm, the survival capacity is underestimated by the routers so as to protect the server from any sudden initial attack. The survival capacity is initialized to minimal or normal values at the beginning of the algorithm and the rate is updated (increased or decreased), based on the server's feedback sent to its child routers and ultimately propagated downward to all routers, in the successive rounds of the algorithm with an assessment to converging the total server load to the acceptable capacity range. 
\section[{D-WARD [20] detects an attack based on constant monitoring of bidirectional traffic flows between}]{D-WARD [20] detects an attack based on constant monitoring of bidirectional traffic flows between} 
\section[{Discover vulnerable hosts or agents}]{Discover vulnerable hosts or agents} 
\section[{Compromising the Vulnerable hosts}]{Compromising the Vulnerable hosts}
\begin{quote}
Agent\end{quote}
\par
Peng et al. \hyperref[b22]{[22]} describe a new approach to detect bandwidth attacks by observing the arrival rate of new source IP addresses. The detection system is based on an advanced non-parametric change detection scheme, CUSUM. Cheng et al. \hyperref[b23]{[23]} propose the IP Flow Feature Value (FFV) algorithm using the vital features of DDoS attacks, such as flow dissymmetry, abrupt traffic change, distributed source IP addresses and concentrated target IP addresses. ARMA prediction model is established for normal network flow using a linear prediction technique. Then a DDoS attack detection scheme based on anomaly detection techniques and linear prediction model (DDAP) is used.\par
Udhayan and Hamsapriya \hyperref[b24]{[24]} defines a Statistical Segregation Method (SSM), by sampling the flow in consecutive intervals and compares the samples with the attack state condition and sorts them based on the mean parameter. Attack flows from legitimate flows are segregated using correlation analysis.\par
In \hyperref[b25]{[25]}, a generic DoS detection scheme was introduced based on maximum likelihood criterion with random neural networks (RNN). This approach initially selects a set of traffic features in offline mode to obtain pdf estimates and to evaluate the probability ratios. It measures the features of incoming traffic and attempts to decide according to each feature to take decision. Lastly, it obtains an overall decision using both feed-forward and recurrent architectures of the RNN. A brief summary of these methods is given in Table \hyperref[tab_0]{1}.\par
In \hyperref[b26]{[26]}, authors present a lightweight tunnelling protocol called LOT, to prevent network traffic against IP spoofing and flooding attacks. It is deployed at network's communication gateways. Two gateways with LOT implementation can detect each other and create the tunnel between them to secure communication. The protocol allows the gateway to discard spoofed IP packets which specify source addresses in other gateway and vice versa and communication can be protected from any type of DDoS attacks. The use of per-flow quotas to identify flooding of packets from different networks mitigation the DDoS attacks. The LOT protocol not only passes restricts spoofed packets to destination and also filter packets based on filtering rules determined by destination gateway.\par
In \hyperref[b27]{[27]}, authors attain DDoS detection with enhanced time limits through non-asymptotic fuzzy estimators. The estimator is deployed on mean packet inter-arrival times. The problem is divided into two parts; one is actual DDoS detection and the other is identification of victim IP addresses. The first part is achieved using strict real time limits for DDoS detection. The second part i.e., identification of victim IP addresses is attained through comparatively relaxed constraints. The goal is to identify victim IP addresses in a timely manner to launch added anti intrusion applications on offended hosts using packet arrival time as the main statistic of DDoS attack determination.\par
A game theoretic approach is followed in \hyperref[b28]{[28]} to offer defense against DoS/DDoS cyber-attacks. The DDoS attack is modelled as a one-shot \& zero-sum game with non-cooperation. To perform an attack, multiple features are investigated in terms of cost with malicious traffic distribution and number of attackers. It is validated in analytical terms that a single optimal strategy of defense is available to defender in which upper boundaries are set to attacker payoff depending upon the rational or irrational attackers. Table \hyperref[tab_2]{2} presents a brief summary of the Statistical based DDoS detection methods. 
\section[{ii. Soft computing based methods}]{ii. Soft computing based methods}\par
Learning paradigms, such as Artificial Neural Networks (ANNs), radial basis functions and genetic algorithms are widely used in DDoS attack detection because of their ability to classify intelligently and automatically. Soft computing is a method of describing a set of optimization and processing techniques that are tolerant of imprecision and uncertainty.\par
Artificial Neural Networks (ANNs) are widely used learning models with their ability to cope with demands of a changing environment \hyperref[b33]{[32]}. These ANNs are self-learning and self-organizing models with the features like robustness, fault tolerance and parallelism. ANNs are good to identify and resist unknown E disturbances in a system because of its self-learning characteristic.\par
In \hyperref[b34]{[33]}, authors use Linear Vector Quantization (LVQ) model of ANN. It is same as self-organizing maps and applied the techniques of pattern recognition, multilayer classification and data compression. In supervised learning, it knows the target output against different forms of various input patterns. After testing the system with LVQ model, authors use the same dataset with Back propagation (BP) model of ANN for comparative study. On the basis of comparison results, they claim that LVQ is more accurate in determining DDoS attacks than BP. They show that LVQ is 99.723\% accurate on average against tested dataset whereas the average accuracy of BP is 89.9259\% for the same dataset. Accuracies are computed on the basis of percentages of obtained false positives and false negatives against each sample of testing data. There are 10 samples used to test the systems for each of the LVQ and BP models.\par
In \hyperref[b35]{[34]}, authors train the BP neural network with a traffic entropy variations dataset as inputs and DDoS strengths as outputs. 20 different samples in the dataset are used for training with 10Mbps attack strength as the lowest and 100Mbps being the highest in the dataset. The entropy variations are calculated based on an assumption that the attack traffic is seen different in the network from normal traffic. The model is tested with random inputs of four entropy variations and calculated attack strengths respectively as 20, 50, 70 and 95Mbps. The BP neural network's output is obtained with little errors. False positives and false negatives are very less and also the system is tested with variations in network size i.e., number of neurons in processing layer but in real cases, increasing the network size also increases both training time and implementation cost.\par
In \hyperref[b36]{[35]}, authors propose Time Delay Neural Network (TDNN) to acquire early warning system against DDoS attacks. TDNN is a neural network in which time delay factor is hidden inside the representative signal.\par
The authors created a Demilitarized Zone (DMZ) and TDNN is implemented in two-layer pattern. The node action is monitored by neighboring nodes and attack information is sent to the expert module for integrated analysis. The layered structure enables the system to ensure some appropriate actions as a proactive strategy against DDoS attacks. The detection results on deployed architecture show that proposed scheme is able to give 82.7\% correct detection rate as compared to 46.3\% with general Intrusion Detection System (IDS).\par
Jalili et al. \hyperref[b37]{[36]} introduce SPUNNID as DDoS attack detection system based on a statistical preprocessor and unsupervised artificial neural network. It use statistical pre-processing to extract features from the traffic, and uses an unsupervised neural network to analyse and classify traffic as an attack or normal traffic.\par
Karimazad and Faraahi \hyperref[b38]{[37]} propose an anomalybased DDoS detection method using Radial Basis Function (RBF) neural networks based on features of attack packets analysis. It is applied to classify data as normal or attack categories. If the incoming traffic is identified as attack traffic, the attack packets source IP address are sent to the Filtering Module and the Attack Alarm Module performs further actions. Otherwise, if the traffic is normal, it is directed to the destination.\par
Gavrilis and Dermatas \hyperref[b39]{[38]} present a detection method for DDoS attacks in public networks based on statistical features estimated in short-time window analysis of incoming data packets. A small number of statistical parameters are used to define the behavior of the DDoS attacks. An accurate classification is achieved using Radial Basis Function neural networks than this. 
\section[{Global Journal of Computer Science and Technology}]{Global Journal of Computer Science and Technology}\par
Volume XIV Issue VII Version I ? Detecting DDoS attacks at source end is difficlut because sources are widely distributed across the network and a single source behaves like a normal traffic. ? The difficulty of deploying system at the source end.\par
Victim-end Defense Architecture\par
? Detecting DDoS attacks in victim routers is relatively easy because of the high rate consumption of resources. ? Best practically applicable type of defense scheme as Web servers providing critical services always try to secure their resources for legitimate users.\par
? During DDoS attacks, victim resources, e.g., network bandwidth, often gets over-whelmed and these approaches cannot stop the flow beyond victim routers. ? Detect the attack only after it reaches the victim and detecting an attack when legitimate clients have already been denied is not useful.\par
Core-end Defense Architecture\par
? Detection and traceback of attack sources are easy in this approach due to collaborative operation.\par
? The traffic is aggregated i.e., both attack and legitimate packets arrive at the router and it is a better place to rate-limit all the traffic.\par
? Deployment is the main difficulty with this approach. ? To attain full detection accuracy, all routers on the Internet will have to follow this detection scheme, because unavailability of this scheme in one router may cause failure to the detection and traceback process. ? Full practical implementation is extremely difficult because it requires the reconfiguration of all the routers on the Internet. Distributed-end or Hybrid Defense architecture\par
? Detection can be done at the victim side and the response can be initiated and distributed to other nodes by the victim. ? Distribution of methods of detection and mitigation at different ends of the network can be more beneficial.\par
? Strong cooperation among the deployment points is required.\par
? Complexity and overhead because of the cooperation and communication among distributed components scattered all over the Internet.\par
Wu et al. \hyperref[b40]{[39]} proposes detection of DDoS attacks using decision trees and grey relational analysis. The detection of the attack from the normal state is defined as a classification problem. They use 15 attributes, to monitor the incoming/outgoing packet/byte rate, and also collect the TCP, SYN, and ACK flag rates, to define the traffic flow pattern. The decision tree method is used to develop a classifier to detect abnormal traffic flow and also use a novel traffic pattern matching procedure to identify traffic flow similar to the attack flow and to trace back the origin of an attack. In \hyperref[b43]{[42]} the authors proposes ensemble of classifiers which uses the Resilient Back Propagation (RBP) neural network as the base classifier for DDoS Detection. They are mainly focussed on improvement of the performance of the base classifier. The RBPBoost combines the output of the ensemble of classifier outputs and Neyman Pearson cost minimization strategy \hyperref[b44]{[43]}, for final classification decision.  
\section[{Distributed}]{Distributed}\par
Hybrid approach which is used to detect and trace back the attack source. 
\section[{Oke and}]{Oke and}\par
Loukas \hyperref[b25]{[25]} Attack detection Victim side Centralized Defines a set of attack specific input features that captures the behavior and the long term statistical properties of the traffic during detection. Saifullah \hyperref[b21]{[21]} Attack prevention Between source and destination network 
\section[{Distributed}]{Distributed}\par
Prevention method which protects Internet servers and routers from DDoS attacks using distributed weight-fair throttling from the upstream routers. Chen \hyperref[b29]{[29]} Attack  methods presented in this section. Table \hyperref[tab_1]{3} presents a brief summary of the soft computing methods presented in this section.\par
iii. Knowledge based Methods\par
In knowledge-based approaches, network events or actions are tested against predefined rules or patterns of attack. In these, general representations of known attacks are called as attack signatures and these are formulated to identify actual occurrences of attacks. Knowledge-based approaches include expert systems, signature analysis, self-organizing maps, and state transition analysis.\par
Gil and Poletto \hyperref[b45]{[44]} present a heuristic data structure named as MULTOPS (MUlti-Level Tree for Online Packet Statistics), that monitor traffic characteristics of network devices like routers to detect and eliminate DDoS attacks. MULTOPS is a tree of nodes which includes traffic rate statistics for subnet prefixes at different aggregation levels and was expansion and contraction of the tree occurs within a pre-specified memory size. A MULTOP of network device detects bandwidth attacks by the occurrence of a significant difference between traffic rates going to and coming from the victim or the attacker. Routers or network monitors equipped MULTOPS may fail to detect a bandwidth attack that is fixed by attackers that randomizes IP attack source addresses on malicious packets. It also fails to detect attacks that deploy a large number of attack flows to explode a victim.\par
Thomas et al. \hyperref[b46]{[45]} introduces a practical approach with high performance DDoS defense mechanism called as NetBouncer. It distinguishes legitimate and illegitimate use of resources and ensuring that are made available only for legitimate use. It allows traffic to flow with respective to a long list of recognized legitimate clients and if packets are received from a source not on the legitimate list, a NetBouncer device invite administer to perform variety of legitimacy tests to test the client to prove its legitimacy. If a client proved its authorization, it is added to the legitimacy list and subsequent packets from the client are accepted.\par
Wang et al. \hyperref[b47]{[46]} present a methodical way of modeling DDoS attacks using Augmented Attack Tree (AAT), and implemented an AAT-based attack detection algorithm. It explicitly captures the specific subtle incidents triggered by a DDoS attack and the corresponding state changes from the observation of the network traffic transmission on the primary victim server. With reference to the conventional attack tree (CAT) modeling method, AAT is advanced because it provides additional information like the state transition process. It overcomes the limitations of CAT modelling.\par
Limwiwatkul and Rungsawang \hyperref[b49]{[47]} discover DDoS attack signatures by analysing the TCP/IP packet header against pre defined rules and conditions, and differentiating the difference between normal and abnormal traffic flow. These mainly focus on ICMP, TCP and UDP flooding attacks.\par
Zhang and Parashar \hyperref[b51]{[48]} introduced a distributed approach to defend against DDoS attacks in the Internet. To detect DDoS attacks independently, defensive systems are deployed in the network, unlike traditional IDS, this method detects and stops DDoS attacks within the intermediate network. An IRC communication is used between these independent detection nodes to exchange information about network attacks and combined this information for aggregate network attacks. Individual defence nodes obtain estimated information about global network attacks and stop the attacks more effectively and accurately using the aggregated information of network. An earlier approach depends on monitoring the volume of traffic received by the victim and these are incompetent of distinguishing a DDoS attack from a flash crowd.\par
Lu et al. \hyperref[b52]{[49]} defines a perimeter-based DDoS defese system, in which the traffic is analyzed at the edge routers of an Internet Service Provider (ISP) network. The DDoS defense system consists of two major components: (1) temporal-correlation based feature extraction and (2) spatial-correlation based detection. It accurately identifies and detect DDoS attacks without changing existing IP forwarding mechanisms at routers. A brief summary of these knowledge based methods is given in Table \hyperref[tab_5]{4}. 
\section[{iv. Data mining and machine learning methods}]{iv. Data mining and machine learning methods}\par
In \hyperref[b53]{[50]} the authors proposed an effective defensive system called as NetShield to protect client hosts, network routers and network servers from becoming victims, zombies and handlers of DDoS flood attacks. It protects any IP-based public network on the Internet and uses preventive and rate limiting to eliminate system vulnerabilities on target machines. It enforces dynamic security policies for protecting network resources against DDoS flood attacks.\par
Chen et al. \hyperref[b54]{[51]} introduces DDoS Container as a comprehensive framework for DDoS attack detection. It uses a network based detection method to defense complex and simple types of DDoS attacks and works in parallel to inspect and control ongoing traffic Lee et al. \hyperref[b55]{[52]} propose proactive detection method for DDoS attacks by exploiting an architecture comprising of a selection of handlers and agents that communicate, compromise and attack. It performs cluster analysis. The authors presented the results using the DARPA dataset, were each phase of the attack scenario is segregated well and can detect originators of a DDoS attack as well as the attack itself.\par
Sekar et al. \hyperref[b56]{[53]} inspect the design space for innetwork DDoS detection and propose a triggered, multistage approach that addresses both scalability and accuracy. They designed and implemented the LADS (Large-scale Automated DDoS detection System), which makes effective use of the data readily available to an ISP.\par
Rahmani et al. \hyperref[b57]{[54]} designed a joint entropy analysis of for DDoS attack detection using multiple traffic distributions. The time series of IPflow numbers and aggregate traffic sizes are statistically dependant and were this occurrence of an attack affects the dependence and causes a break in the time series for joint entropy values.\par
A low-rate DDoS attack detection difficult compared with the Normal attacks because of its similarity with normal traffic. In \hyperref[b58]{[55]} defined two new information metrics: (i) generalized entropy metric and (ii) information distance metric, to detect low-KK DDoS attacks. The attack is detected based on the distance between legitimate and attack traffic. The generalized entropy metric is more accurate than the traditional Shannon metric \hyperref[b59]{[56]}.\par
In \hyperref[b60]{[57]} early detection of flooding DDoS attacks are defined using FireCol, which is based on information theory. It is deployed in Internet service provider (ISP) level as a part of intrusion prevention system (IPS). The IPSs create virtual protection rings around the hosts to defend and cooperate by exchanging specific traffic information.\par
The approach described in \hyperref[b61]{[58]} analyses characteristics of DDoS and flash crowd attacks and provides an efficient way to distinguish between the two in VoIP networks. The authors validated the method through simulation.\par
In \hyperref[b62]{[59]} the authors present a wavelet transformation and probability theory based network anomaly detection approach. It is able to identify known as well as unknown DDoS attacks.\par
Zhong and Yue \hyperref[b64]{[60]} implemented a DDoS attack detection model which extracts a network traffic and a network packet protocol status models and defines the threshold for the detection model. K-Means clustering algorithm is used to build initial threshold values for network traffic of Captured network traffic values. Packet protocol status model is built using Apriori \hyperref[b65]{[61]} and FCM \hyperref[b66]{[62]} for captured packets. When the current network traffic exceeds the threshold value, the network packet protocol status is checked to identify abnormal packets. If there are no abnormal packets exist, a new threshold value model is build based on the current network using k-means module.\par
A two-stage automated detection system is proposed in \hyperref[b67]{[63]} for DoS attacks in network traffic. It is the combination of traditional change point detection method with wavelet transforms \hyperref[b68]{[64]}. In \hyperref[b69]{[65]}, Li and Lee present a systematic wavelet based method for DDoS attack detection. DDoS attack traffic is detected using energy distribution based on wavelet analysis. Energy distribution over time has limited variation if the traffic keeps change its behavior over time.\par
Gupta et al. \hyperref[b70]{[66]} use ANN to identify the number of zombies in a DDoS attack. Sample data is used to train a feed-forward neural network created using the NS-2 network simulator. The generalization capacity of the trained network is capable and it is able to calculate the number of zombies involved in a DDoS attack with test error.\par
Cheng et al. \hyperref[b72]{[68]} proposes the IP Address Interaction Feature (IAI) algorithm considering abrupt traffic changes, interactions among addresses, manyto-one asymmetries among addresses, distributed source and concentrated target addresses. The IAI algorithm is designed to describe the critical characteristics of network flow states. A support vector machine (SVM) classifier, which is trained by an IAI time series with normal and attack flows, is applied to classify the state of current network flows and identify the DDoS attacks. It has higher detection and lower false alarm rates compared to competing techniques.\par
The method defined in \hyperref[b74]{[69]} identifies flooding attacks in real time and also assess the strength of the attackers based on fuzzy reasoning. This process consists of two stages: (i) statistical analysis of the network traffic time series and (ii) identification and assessment of the strength of the DDoS attack based on an intelligent fuzzy reasoning mechanism.\par
Zhang et al.   low-rate DDoS (LDDoS) attacks. A flow of higher CPR value leads to LDDoS and subsequent dropping of the packets. It identifies DDoS attacks with high detection accuracy using correlation of subset of features.\par
In \hyperref[b76]{[71]}, authors defined an approach to detect botnet and their activities based on traffic behaviour analysis. Machine learning strategies are used to classify traffic behaviour and proved experimentally that botnet activities can be identified in smaller time windows with high accuracy.\par
In \hyperref[b77]{[72]}, low-rate DDoS attacks are detected using anomaly based approach. In low-rate DDoS attacks methods, attackers send malicious traffic at lower transmission rate to mislead traditional anomaly based DDoS detection techniques. The authors proposed two information metrics, generalized entropy metric and information distance metric. These metrics are used to measure difference between legitimate traffic and attack traffic to detect DDoS attacks.\par
In \hyperref[b78]{[73]}, a mathematical model is proposed to provide the benefits of DDoS defence based on dropping of attack traffic. The authors used an autonomic defence mechanism based on Cognitive Packet Network (CPN) protocol to tracing back flows coming into a node automatically. A summarized presentation of these methods in this category is given in Table \hyperref[tab_6]{5}. 
\section[{IV. Traceback Mechanisms}]{IV. Traceback Mechanisms}\par
Identifying attack source(s) through some mechanism to block or mitigate the attack at origin is referred as Traceback in DDoS defense. Implementing the traceback to identify DDoS source accurately is difficult because of, easy spoofing of source IP addresses, stateless nature of IP routing without knowing the complete path, link layer or MAC address spoofing and modern attack tools provides to implement intelligent attack techniques easily \hyperref[b79]{[74]}.\par
In \hyperref[b80]{[75]}, authors calculated entropy variations of network traffic to implement a traceback scheme. To detect an attack the difference of entropy values between normal traffic and the DDoS attack traffic is calculated. If the attack is detected, the traceback is initiated towards its upstream routers. The proposed scheme provides an advantage over traditional traceback approaches in terms of scalability and storage requirements in victim or intermediate routers. It stores only short-term information i.e, entropy values of successive time intervals in order to detect the DDoS attack.\par
In \hyperref[b81]{[76]}, authors presents a method for detection and traceback of low-rate DDoS attacks ,where low-rata attacks are very much similar to normal traffic and have more ability to hide their attack related identities in the aggregate traffic. Two new information metrics were introduced to detect low-rate DDoS attacks, which are generalized entropy metric and information distance metric. In this approach, difference between legitimate and attack traffic is identified through the proposed information metrics and are capable to detect the attack in prier hops earlier than counts mentioned in proposed schemes. These information metrics increase detection accuracy of the system and is capable of identifying low-rate DDoS attacks effectively by reducing false positive rates.\par
In addition to entropy variation scheme, other traditional reactive methods also exist to traceback DDoS attack sources \hyperref[b79]{[74]}. In packet marking scheme, trace the path through upstream routers towards the attack sources i.e., zombies. It is a standard technique used in traceback implementations, however contains some inherent drawbacks. There exits two types of packet marking schemes i.e., probabilistic and deterministic packet marking.\par
In probabilistic packet marking (PPM), every router inserts its IP address probabilistically into the packets moving from source to destination. The method relies on the assumption that attack packets more frequent than legitimate packets. Once the attack is detected, the victim requests sufficient range of packets to reconstruct the path upto the attack source through embedded information within the packets. There is no specific fields defined in an IP packet for markings. Therefore, it utilizes infrequently used 16-bit fragment ID in IP packets for the markings \hyperref[b83]{[78]}. However, this method has some major drawbacks. For instance, it is valid just for direct attacks. It cannot detect the original location of attack source just in case of reflector attacks Traces the origin of IP packet with 11 bit hash and distance field of 3 bits are generated using 32 bit IP address and stored in IP header.\par
Low overhead on router and network and computational complexity is very less. 
\section[{No time synchronization between victim and the router and Secret key is shared between routers. Fast Internet Traceback}]{No time synchronization between victim and the router and Secret key is shared between routers. Fast Internet Traceback}\par
A packet marking scheme and path reconstruction algorithms are used at routers and end hosts to receive the packet markings. 
\section[{Minimal}]{Minimal}\par
Processing time is required to traceback the attack source for less flow.\par
False positive rates are high. Deterministic packet marking \hyperref[b83]{[78]} The source of an attack flow is identified by employing tracing information inscribed in the packet. 
\section[{Traceback}]{Traceback}\par
process requires small number of packets.\par
No overload prevention and Increase in packet header size. Probabilistic packet marking \hyperref[b83]{[78]} Routers mark the packets with probabilistic path information and victim reconstructs the attack graph.\par
Efficiency and easy implementabilty over Deterministic Packet Marking.\par
More number of packets and computational work involved in traceback process. Probability of finding the source traced is low. Flexible Deterministic Packet marking \hyperref[b79]{[74]} Large scale IP Trace back scheme which encodes the information and reconstruction the attack path using mark recognition. Using Honeypots \hyperref[b15]{[16]} Honeypots are used as the proxy servers and the attack source is traced through honeypot entries. E analysis \hyperref[b17]{[18]} attack strength. New information metrics \hyperref[b16]{[17]} Information distances are calculated for each flow in the network. Less computational complexity for calculating the information distance.\par
Accurate detection is not possible.\par
In deterministic packet marking (DPM), the router inserts its IP address deterministically into the IP packets. This scheme was introduced to overcome the drawbacks of probabilistic packet marking, because it has easy implementation and needs less computational overhead on intermediate routers. However, it also has the limitations. In this scheme, packets are marked only by first ingress edge router with the information i.e., the entire is not stored as in PPM. Therefore, it needs even additional packets to reconstruct the attack path \hyperref[b79]{[74]}. Furthermore, it additionally has some limitations similar to PPM scheme discussed above. This approach is less efficient than traditional schemes.\par
In packet logging scheme \hyperref[b79]{[74]} which is also referred as Source Path Isolation Engine (SPIE), the information of each packet is stored or logged at routers through which the packet is passed. The routers in this approach are termed as Data Generation Agents (DGAs). The stored information of the packet includes constant header fields and first 8 bytes of the digests (payload hashed through many hash functions). Bloom filters are used to store these DGAs, which is a spaceefficient data structure and is capable of reducing storage requirements by large magnitude.\par
In ICMP messaging scheme \hyperref[b82]{[77]}, routers are programmed to send ICMP messages together with the network traffic. The ICMP packets contain path information such as source address, destination address and authentication parameters etc. A typical router with this scheme normally sends one ICMP messaging packet for every 20,000 packets passing through it i.e., a traceback message is sent with the proportion of 0.005 percent of the network traffic \hyperref[b79]{[74]}. A summarized presentation of these methods in this category is given in Table \hyperref[tab_7]{6}. 
\section[{V. Conclusion And Work}]{V. Conclusion And Work}\par
In this paper, we have presented a broad classification of various DDoS attacks, DDoS Defensive architectures such as Source-end, Victim-end and Intermediate architectures. We have also presented various Detection and mitigation mechanisms such as Statistical based, Soft-computing based, Knowledge based and Data mining based approaches along with their advantages and disadvantages based on where and when they detect and respond to DDoS attacks. Finally, we presented an overview of traceback mechanisms of DDoS attacks such as packet marking schemes, information distance, honey pots and entropy variations. Practically it is very difficult to design and implement DDoS defense and detection. In real time networks, fulfilling all the requirements for DDoS detection is not possible and to accomplish this, various performance parameters need to be balanced against each other delicately and appropriately. 
\section[{Global Journal of Computer Science and Technology}]{Global Journal of Computer Science and Technology}\par
Volume XIV Issue VII Version I \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-2.png}
\caption{\label{fig_1}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-3.png}
\caption{\label{fig_2}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-4.png}
\caption{\label{fig_3}3 .}\end{figure}
         \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.1681058495821727\textwidth}P{0.6511142061281336\textwidth}P{0.030779944289693592\textwidth}}
Defense\tabcellsep Advantages\tabcellsep Disadvantages\\
Method\tabcellsep \tabcellsep \\
Source-end\tabcellsep ? Detecting and stopping a DDoS attack at the\tabcellsep \\
Defense\tabcellsep source provides best possible defense as\tabcellsep \\
Architecture\tabcellsep minimum damage is done on legitimate\tabcellsep \\
\tabcellsep traffic.\tabcellsep \\
\tabcellsep ? Minimum amount of traffic to be checked at\tabcellsep \\
\tabcellsep source point for which fewer resources are\tabcellsep \\
Year 2014\tabcellsep required by the detection \& mitigation mechanism.\tabcellsep \\
22\tabcellsep \tabcellsep \\
D D D D D D D D )\tabcellsep \tabcellsep \\
(\tabcellsep \tabcellsep \end{longtable} \par
  {\small\itshape [Note: E]} 
\caption{\label{tab_0}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3} \par 
\begin{longtable}{P{0.85\textwidth}}
presents a\end{longtable} \par
  {\small\itshape [Note: E]} 
\caption{\label{tab_1}Table 3}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.13099652375434528\textwidth}P{0.12213209733487833\textwidth}P{0.04136732329084589\textwidth}P{0.016743916570104284\textwidth}P{0.05515643105446118\textwidth}P{0.483603707995365\textwidth}}
Reference\tabcellsep Objective\tabcellsep \multicolumn{2}{l}{Deployment}\tabcellsep Working Mode\tabcellsep Remarks\\
\multicolumn{4}{l}{Mirkoviac al. et[20] Attack prevention Source side}\tabcellsep Centralized\tabcellsep Statistical traffic modelling is used to\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep Detect DDoS attacks and blocks the\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep attack traffic when it is detected at source\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep end.\\
Akella.et al.[31]\tabcellsep \multicolumn{3}{l}{Attack detection Source and victim}\tabcellsep Distributed\tabcellsep A profile is constructed from normal traffic\\
\tabcellsep \tabcellsep side\tabcellsep \tabcellsep \tabcellsep and detects anomalies in the traffic using\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep stream sampling. In general this\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep approach used in the network routers.\\
Prasad,\tabcellsep \multicolumn{3}{l}{Attack detection victim side}\tabcellsep Distributed\tabcellsep Modeling and Counter measures of\\
ARMReddy,\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep Flooding attacks to ITM using Botnet and\\
KVGRrao[41]\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep Group Testing.\\
Peng.et al.[22]\tabcellsep Detecting\tabcellsep \multicolumn{2}{l}{Victim side}\tabcellsep Centralized\tabcellsep Sequential nonparametric change point\\
\tabcellsep bandwidth\tabcellsep \tabcellsep \tabcellsep \tabcellsep detection method is used to improve the\\
\tabcellsep attacks\tabcellsep \tabcellsep \tabcellsep \tabcellsep detection accuracy and employed at\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep victim end.\\
Chen.et al.[19]\tabcellsep Attack\tabcellsep Between\tabcellsep source\tabcellsep \\
\tabcellsep detection\tabcellsep and\tabcellsep destination\tabcellsep \\
\tabcellsep and Traceback\tabcellsep network\tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_2}Table 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3} \par 
\begin{longtable}{P{0.10310296191819464\textwidth}P{0.12468265162200282\textwidth}P{0.046755994358251056\textwidth}P{0.06713681241184767\textwidth}P{0.5083215796897037\textwidth}}
Reference\tabcellsep Objective\tabcellsep Deployment\tabcellsep Working Mode\tabcellsep Remarks\\
\multicolumn{2}{l}{Jalili.et al[36] Attack}\tabcellsep Victim side\tabcellsep Centralized\tabcellsep Statistical preprocessor and unsupervised\\
\tabcellsep detection\tabcellsep \tabcellsep \tabcellsep neural network classifier methods were used\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep for DDoS attack detection.\\
Gavrilis\tabcellsep \multicolumn{2}{l}{Attack detection Victim side}\tabcellsep Centralized\tabcellsep Detects DDoS attacks using statistical\\
\&Dermatas[38]\tabcellsep \tabcellsep \tabcellsep \tabcellsep features estimated in short time interval in\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep public network with Radial basis function of\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep neural network.\\
Nguyen and\tabcellsep \multicolumn{2}{l}{Attack detection Intermediate}\tabcellsep Centralized\tabcellsep K-nearest neighbour based technique is used\\
Choi[40]\tabcellsep \tabcellsep network\tabcellsep \tabcellsep to detect only known attacks.\\
Wu et al. [39]\tabcellsep Attack detection\tabcellsep Victim side\tabcellsep Distributed\tabcellsep Trace back to the attacker location based on\\
\tabcellsep and traceback\tabcellsep \tabcellsep \tabcellsep traffic flow pattern matching using decision\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep trees.\end{longtable} \par
 
\caption{\label{tab_4}Table 3 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{4} \par 
\begin{longtable}{P{0.09444444444444444\textwidth}P{0.0015873015873015873\textwidth}P{0.08333333333333333\textwidth}P{0.07777777777777777\textwidth}P{0.06825396825396826\textwidth}P{0.5246031746031746\textwidth}}
Reference\tabcellsep \tabcellsep \multicolumn{2}{l}{Objective Deployment}\tabcellsep \multicolumn{2}{l}{Working Mode Remarks}\\
\multicolumn{2}{l}{Gil and Po-}\tabcellsep Attack\tabcellsep Between\tabcellsep Centralized\tabcellsep Each network device maintains a MULTOPS\\
Letto [44]\tabcellsep \tabcellsep prevention\tabcellsep source and\tabcellsep \tabcellsep data structure to detect attacks that deploy\\
\tabcellsep \tabcellsep \tabcellsep destination\tabcellsep \tabcellsep a large number of DDoS attack flows using\\
\tabcellsep \tabcellsep \tabcellsep network\tabcellsep \tabcellsep a large number of agent and IP spoofing\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep attacks.\\
Thomas\tabcellsep et\tabcellsep Attack\tabcellsep Victim side\tabcellsep Centralized\tabcellsep Inline packet processing is used by the Net\\
al.[45]\tabcellsep \tabcellsep detection\tabcellsep \tabcellsep \tabcellsep Bouncer to differentiate DDoS traffic from\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep flash crowd based on network processor\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep technology.\\
\multicolumn{2}{l}{Limwiwatkul}\tabcellsep Attack\tabcellsep Victim side\tabcellsep Distributed\tabcellsep Attack signature models are constructed\\
\&\tabcellsep \tabcellsep detection\tabcellsep \tabcellsep \tabcellsep using TCP packet headers for DDoS attack\\
Rung-\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep detection.\\
\multicolumn{2}{l}{Sawang[47]}\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{2}{l}{Zhang and}\tabcellsep Proactive\tabcellsep Intermediate\tabcellsep Distributed\tabcellsep A gossip based scheme uses global\\
\multicolumn{2}{l}{Parashar[48]}\tabcellsep \tabcellsep network\tabcellsep \tabcellsep information about DDoS attacks by\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep information sharing to detect attacks.\\
Lu et al.[49]\tabcellsep \tabcellsep Attack\tabcellsep Edge router\tabcellsep Distributed\tabcellsep Exploits spatial and temporal correlation of\\
\tabcellsep \tabcellsep detection\tabcellsep \tabcellsep \tabcellsep DDoS attack traffic for detecting anomalous\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep packet.\\
Wang.et.\tabcellsep \tabcellsep Attack\tabcellsep Victim side\tabcellsep Centralized\tabcellsep Augmented Attack Tree model is used for\\
\multicolumn{2}{l}{al[4}\tabcellsep detection\tabcellsep \tabcellsep \tabcellsep the detection of DDoS attacks.\\
6]\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_5}Table 4 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{5} \par 
\begin{longtable}{P{0.13076923076923078\textwidth}P{0.0034412955465587046\textwidth}P{0.08431174089068826\textwidth}P{0.05964912280701754\textwidth}P{0.5678137651821862\textwidth}P{0.004014844804318489\textwidth}}
Reference\tabcellsep \tabcellsep Objective\tabcellsep Deployment\tabcellsep Working\tabcellsep Remarks\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep mode\\
Hwang\tabcellsep et\tabcellsep \multicolumn{2}{l}{Attack prevention Victim side}\tabcellsep \multicolumn{2}{l}{Centralized Protects network clients, routers and servers}\\
al.[50]\tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{from DDoS attacks using protocol anomaly}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep detection\\
\multicolumn{3}{l}{Li and Lee[52] Attack detection}\tabcellsep Victim end\tabcellsep \multicolumn{2}{l}{Centralized An energy distribution based wavelet analysis}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{technique defined for the detection of DDoS}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep traffic.\\
\multicolumn{3}{l}{Sekar.Et.al[53] Attack detection}\tabcellsep Source side\tabcellsep \multicolumn{2}{l}{Distributed A triggered multi-stage approach is defined}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{to acquire scalability and accuracy for DDoS}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep attack detection.\\
Gelenbe and\tabcellsep \tabcellsep DDoS defense\tabcellsep Victim end\tabcellsep \multicolumn{2}{l}{Centralized Detects attack by tracing back flows}\\
Loukas[73]\tabcellsep \tabcellsep \tabcellsep \tabcellsep automatically.\\
\multicolumn{3}{l}{Lee et al.[62] Attack detection}\tabcellsep Source side\tabcellsep \multicolumn{2}{l}{Centralized Agent handler architecture along with cluster}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{analysis is used to Detects DDoS attack}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep proactively.\\
Rahmani\tabcellsep et\tabcellsep Attack detection\tabcellsep Victim side\tabcellsep \multicolumn{2}{l}{Distributed A joint entropy analysis used for multiple}\\
al[54]\tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{traffic distributions to detect DDoS attacks.}\\
Li and Li[65]\tabcellsep \tabcellsep Attack detection\tabcellsep Victim end\tabcellsep \multicolumn{2}{l}{Centralized Wavelet transformation and probability theory}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{are used to detect DDoS attacks}\\
Dainotti\tabcellsep et\tabcellsep Detection of DoS\tabcellsep Victim end\tabcellsep \multicolumn{2}{l}{Centralized Detects attacks accurately using combination}\\
al[63]\tabcellsep \tabcellsep attack anomalies\tabcellsep \tabcellsep \multicolumn{2}{l}{of traditional change point detection and}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{continuous wavelet transformation.}\\
Zhong and\tabcellsep \tabcellsep Attack detection\tabcellsep Victim side\tabcellsep \multicolumn{2}{l}{Centralized Unknown DDoS attacks are detected using}\\
Yue[60]\tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{fuzzy c-means clustering and Apriori}\\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep techniques.\\
\multicolumn{3}{l}{Xia et al. [69] Detects flood attack}\tabcellsep Victim end\tabcellsep \multicolumn{2}{l}{Centralized Detection of DDoS flooding attack using}\\
\tabcellsep \tabcellsep and its intensity\tabcellsep \tabcellsep fuzzy logic.\end{longtable} \par
 
\caption{\label{tab_6}Table 5 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{6} \par 
\begin{longtable}{P{0.08300180831826401\textwidth}P{0.13141952983725136\textwidth}P{0.2920433996383363\textwidth}P{0.14755877034358048\textwidth}P{0.006148282097649186\textwidth}P{0.003074141048824593\textwidth}P{0.18060578661844484\textwidth}P{0.002305605786618445\textwidth}P{0.0038426763110307413\textwidth}}
Year 2014\tabcellsep Existing mechanisms Hash Based\tabcellsep Traceback Working Principle 20 byte IP header and first 8 bytes of\tabcellsep \multicolumn{3}{l}{Advantages It requires low storage}\tabcellsep Drawbacks Increases\tabcellsep the\tabcellsep false\\
\tabcellsep IP Traceback\tabcellsep payload is logged for every packet\tabcellsep and\tabcellsep protects\tabcellsep from\tabcellsep \multicolumn{2}{l}{positives and Overhead}\\
28\tabcellsep \tabcellsep by the Intermediate routers. Hashing is performed on the logged data.\tabcellsep \multicolumn{2}{l}{eavesdropping.}\tabcellsep \tabcellsep \multicolumn{2}{l}{in generating 28 byte hash for the packets.}\\
Volume XIV Issue VII Version I\tabcellsep Algebraic approach to IP traceback Enhanced ICMP traceback-Cumulative path[77] Advanced and Authenticated\tabcellsep Polynomial functions are used to generate traceback data and stores in unused bits of IP header. Intermediate routers generate Itrace-CP message. The victim uses this message to trace the attack path and source.\tabcellsep \multicolumn{3}{l}{Noise elimination and multiple path reconstruction are possible and robustness is improved. In less time it constructs an entire attack path.}\tabcellsep \multicolumn{2}{l}{Variations will occur in random full path tracing schemes and poor scaling. A change to be made to the router and space is required to process packets.}\\
D D D D D D D D )\tabcellsep scheme for IP Traceback.\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
(\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
Global Journal of Computer Science and Technology\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
  {\small\itshape [Note: Ebecause the]} 
\caption{\label{tab_7}Table 6 :}\end{figure}
 			\footnote{© 2014 Global Journals Inc. (US)} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[
			June
		 ()]{b32}\label{b32} 	 		\textit{},  		 			June 		.  		2003. ACM. p. .  	 
\bibitem[October ()]{b50}\label{b50} 	 		\textit{},  		 			October 		.  	 	 		\textit{IEEE CS}  		2004. p. .  	 
\bibitem[May ()]{b19}\label{b19} 	 		\textit{},  		 			May 		.  	 	 		\textit{IEEE CS}  		2006. p. .  	 
\bibitem[October ()]{b63}\label{b63} 	 		\textit{},  		 			October 		.  	 	 		\textit{IEEE}  		2009. p. .  	 
\bibitem[November ()]{b73}\label{b73} 	 		\textit{},  		 			November 		.  	 	 		\textit{IEEE CS}  		2009. p. .  	 
\bibitem[July ()]{b48}\label{b48} 	 		\textit{},  		 			July 			\mbox{}\\  				IEEE CS. 			 		.  		2010. p. .  	 
\bibitem[Karimazad and Faraahi ()]{b38}\label{b38} 	 		‘A "An anomalybased method for DDoS attacks detection using rbf neural networks’.  		 			R Karimazad 		,  		 			A Faraahi 		.  	 	 		\textit{Proceedings of the International Conference on Network and Electronics Engineering},  				 (the International Conference on Network and Electronics EngineeringSingapore)  		2011. IACSIT Press. p. .  	 
\bibitem[Dainotti et al. ()]{b67}\label{b67} 	 		‘A cascade architecture for DoS attacks detection based on the wavelet transform’.  		 			A Dainotti 		,  		 			A Pescap´e 		,  		 			G Ventre 		.  	 	 		\textit{Journal of Computer Security}  		2009. 17 p. .  	 
\bibitem[Kashyap and Bhattacharyya (2012)]{b4}\label{b4} 	 		‘A DDoS attack detection mechanism based on protocol specific traffic features’.  		 			H J Kashyap 		,  		 			D K Bhattacharyya 		.  	 	 		\textit{Proceedings of the Second International Conference on Computational Science, Engineering and Information Technology},  				 (the Second International Conference on Computational Science, Engineering and Information TechnologyCoimbatore, India)  		26-28 October. 2012. ACM. p. .  	 
\bibitem[Oke and Loukas ()]{b25}\label{b25} 	 		‘A denial of service detector based on maximum likelihood detection and the random neural network’.  		 			G Oke 		,  		 			G 		,  		 			G Loukas 		.  	 	 		\textit{Computer. Journal}  		2007. 50 p. .  	 
\bibitem[Dunn ()]{b66}\label{b66} 	 		‘A Fuzzy Relative of the ISODATA Process and Its Use in Detecting Compact Well-Separated Clusters’.  		 			J C Dunn 		.  	 	 		\textit{Journal of Cybernetics}  		1973. 3 p. .  	 
\bibitem[Spyridopoulos et al. ()]{b28}\label{b28} 	 		‘A game theoretic defence framework against DoS/ DDoS cyber-attacks’.  		 			T Spyridopoulos 		,  		 			G Karanikas 		,  		 			T Tryfonas 		,  		 			T Oikonomou 		,  		 			G 		.  		 \xref{http://dx.doi.org/10.1016/j.cose.2013.03.014}{10.1016/j.cose.2013.03.014}.  	 	 		\textit{Computer Security}  		2013.  	 
\bibitem[Shannon ()]{b59}\label{b59} 	 		‘A mathematical theory of communication’.  		 			C E Shannon 		.  	 	 		\textit{Bell system technical journal}  		1948. 27 p. .  	 
\bibitem[Li and Li]{b62}\label{b62} 	 		‘A new approach for detecting DDoS attacks based on wavelet analysis’.  		 			M Li 		,  		 			M Li 		.  	 	 		\textit{Proceedings of the 2nd International Congress on Image and Signal Processing},  				 (the 2nd International Congress on Image and Signal ProcessingTianjin, China)  		p. .  	 
\bibitem[Chen ()]{b29}\label{b29} 	 		‘A new detection method for distributed denial-of-service attack traffic based on statistical test’.  		 			C L Chen 		.  	 	 		\textit{Journal of Universal Computer Science}  		2009. 15 p. .  	 
\bibitem[Yan et al. (2008)]{b71}\label{b71} 	 		‘A new way to detect DDoS attacks within single router’.  		 			R Yan 		,  		 			Q Zheng 		,  		 			G Niu 		,  		 			S Gao 		.  	 	 		\textit{Proceedings of the 11th IEEE Singapore International Conference on Communication Systems},  				 (the 11th IEEE Singapore International Conference on Communication SystemsGuangzhou, China)  		19-21 November. 2008. p. .  	 
\bibitem[Scott and Nowak ()]{b44}\label{b44} 	 		‘A neyman-pearson approach to statistical learning’.  		 			C Scott 		,  		 			R Nowak 		.  	 	 		\textit{IEEE Transaction on Information Theory}  		2005. 51 p. .  	 
\bibitem[Zhang et al. (2009)]{b30}\label{b30} 	 		‘A prediction-based detection algorithm against distributed denial-of-service attacks’.  		 			G Zhang 		,  		 			S Jiang 		,  		 			G Wei 		,  		 			Q Guan 		.  	 	 		\textit{Proceedings of the International Conference on Wireless Communications and Mobile Computing: Connecting the World Wirelessly},  				 (the International Conference on Wireless Communications and Mobile Computing: Connecting the World WirelesslyLeipzig, Germany)  		June. 2009. ACM. p. .  	 
\bibitem[Gelenbe and Loukas ()]{b78}\label{b78} 	 		‘A self-aware approach to denial of service defence’.  		 			E Gelenbe 		,  		 			G Loukas 		.  	 	 		\textit{Computer Networks}  		2007. 51 p. .  	 
\bibitem[Lin and Chiueh ()]{b5}\label{b5} 	 		\textit{A survey on solutions to distributed denial of service attacks},  		 			S Lin 		,  		 			T C Chiueh 		.  		 TR201.  		2006.  		 			Department of Computer Science, State University of New York, Stony Brook. 		 	 	 (Technical Report) 
\bibitem[Mirkovic and Reiher (2004)]{b7}\label{b7} 	 		‘A taxonomy of DDoS attack and DDoS defense mechanisms’.  		 			J Mirkovic 		,  		 			P Reiher 		.  	 	 		\textit{ACM SIGCOMM Computer Communications Review}  		April 2004. 34  (2)  p. .  	 
\bibitem[Jeyanthi and Iyengar ()]{b61}\label{b61} 	 		‘An entropy based approach to detect and distinguish DDoS attacks from flash crowds in VoIP networks’.  		 			N Jeyanthi 		,  		 			N C S N Iyengar 		.  	 	 		\textit{International Journal of Network Security}  		2012. 14 p. .  	 
\bibitem[Chen et al. ()]{b54}\label{b54} 	 		‘An inline detection and prevention framework for distributed denial of service attacks’.  		 			Z Chen 		,  		 			Z Chen 		,  		 			A Delis 		.  	 	 		\textit{Computer. Journal}  		2007. 50 p. .  	 
\bibitem[Gupta et al. ()]{b70}\label{b70} 	 		‘ANN based scheme to predict number of zombies in DDoS attack’.  		 			B B Gupta 		,  		 			R C Joshi 		,  		 			M Misra 		.  	 	 		\textit{International Journal of Network Security}  		2012. 14 p. .  	 
\bibitem[Chandola et al. ()]{b1}\label{b1} 	 		‘Anomaly detection: A survey’.  		 			V Chandola 		,  		 			A Banerjee 		,  		 			V Kumar 		.  		 15:1-15:58..  	 	 		\textit{ACM Computing Survey}  		2009. 41.  	 
\bibitem[Mirkoviac et al. (2002)]{b20}\label{b20} 	 		‘Attacking DDoS at the source’.  		 			J Mirkoviac 		,  		 			G Prier 		,  		 			P Reiher 		.  	 	 		\textit{Proceedings of the 10th IEEE International Conference on Network Protocols},  				 (the 10th IEEE International Conference on Network ProtocolsParis, France)  		November. 2002. IEEE CS. p. .  	 
\bibitem[Wang et al. (2001)]{b47}\label{b47} 	 		‘Augmented attack tree modelling of distributed denial of services and tree based attack detection method’.  		 			J Wang 		,  		 			R C W Phan 		,  		 			J N Whitley 		,  		 			D J Parish 		.  	 	 		\textit{Proceedings of the 10th IEEE International Conference on Computer and Information Technology},  				 (the 10th IEEE International Conference on Computer and Information TechnologyBradford, UK)  		29 June-1.  	 
\bibitem[Zhao et al. ()]{b76}\label{b76} 	 		\textit{Botnet detection based on traffic behaviour analysis and flow intervals},  		 			D Zhao 		,  		 			I Traore 		,  		 			B Sayed 		,  		 			W Lu 		,  		 			S Saad 		,  		 			A Ghorbani 		,  		 			D Garant 		.  		 \xref{http://dx.doi.org/10.1016/j.cose.2013.04.007}{10.1016/j.cose.2013.04.007}.  		2013.  		 			Computer Security 		 	 
\bibitem[Liu et al. ()]{b13}\label{b13} 	 		‘Botnet: Classification, Attacks, Detection, Tracing, and Preventive Measures’.  		 			Xiao J Y Liu 		,  		 			K Ghaboosi 		,  		 			. H Deng 		,  		 			J Zhang 		.  		 ID 692654.  	 	 		\textit{EURASIP Journal. Wireless Communications and Networking}  		2009. 2009. p. 11.  	 
\bibitem[Puri (2003)]{b10}\label{b10} 	 		\textit{Bots and Botnet -an overview},  		 			Puri 		.  		 \url{http://www.giac.org/practical/GSEC/RamneekPuriGSEC.epsReferencesRéférencesReferenciasFuture}  		Aug. 08, 2003.  	 
\bibitem[Zhang and Parashar ()]{b51}\label{b51} 	 		‘Cooperative defence against DDoS attacks’.  		 			G Zhang 		,  		 			M Parashar 		.  	 	 		\textit{Journal of Research and Practice in Information Technology}  		2006. 38 p. .  	 
\bibitem[Wu et al. ()]{b17}\label{b17} 	 		‘DDoS "detection and traceback with decision tree and grey relational analysis’.  		 			Y Wu 		,  		 			, Tseng 		,  		 			H R Yang 		,  		 			W 		,  		 			Jan 		,  		 			RH 		.  	 	 		\textit{International Journal of Ad Hoc and Ubiquitous Computing}  		2011. 7 p. .  	 
\bibitem[Li and Lee ()]{b69}\label{b69} 	 		‘DDoS attack detection and wavelets’.  		 			L Li 		,  		 			G Lee 		.  	 	 		\textit{Proceedings. of the 12th International Conference on Computer Communications and Networks},  				 (of the 12th International Conference on Computer Communications and NetworksDallas, Texas, USA)  		October 20-22. 2003. IEEE. p. .  	 
\bibitem[Liu et al. ()]{b34}\label{b34} 	 		‘DDoS Attack Detection Based on Neural Network’.  		 			Y Liu 		,  		 			J Li 		,  		 			L Gu 		.  	 	 		\textit{Proceedings of IEEE 2nd International Symposium on Aware Computing (ISAC)},  				 (IEEE 2nd International Symposium on Aware Computing (ISAC))  		2010. p. .  	 
\bibitem[Cheng et al. (2009)]{b23}\label{b23} 	 		‘DDoS attack detection method based on linear prediction model’.  		 			J Cheng 		,  		 			Yin 		,  		 			J Wu 		,  		 			C Zhang 		,  		 			Y Li 		.  	 	 		\textit{Proceedings of the 5th international conference on Emerging intelligent computing technology and applications},  				 (the 5th international conference on Emerging intelligent computing technology and applicationsUlsan, South Korea)  		16-19 September. 2009. Springer-Verlag. p. .  	 
\bibitem[Lee et al. ()]{b55}\label{b55} 	 		\textit{DDoS attack detection method using cluster analysis. Expert Systems with Applications},  		 			K Lee 		,  		 			J Kim 		,  		 			K H Kwon 		,  		 			Y Han 		,  		 			S Kim 		.  		2008. 34 p. .  	 
\bibitem[Cheng et al.]{b72}\label{b72} 	 		‘DDoS attack detection using IP address feature interaction’.  		 			J Cheng 		,  		 			J Yin 		,  		 			Y Liu 		,  		 			Z Cai 		,  		 			C Wu 		.  	 	 		\textit{Proceedings of the 1st International Conference on Intelligent Networking and Collaborative Systems},  				 (the 1st International Conference on Intelligent Networking and Collaborative SystemsBarcelona, Spain)  		p. .  	 
\bibitem[Senthil Mahesh et al. ()]{b77}\label{b77} 	 		‘DDoS Attacks Defense System Using Information Metrics’.  		 			P C Senthil Mahesh 		,  		 			S Hemalatha 		,  		 			P Rodrigues 		,  		 			A Shanthakumari 		.  	 	 		\textit{Proceedings of 3rd International Conference on Trends in Information, Telecommunication and Computing},  		Lecture Notes in Electrical Engineering  		 (3rd International Conference on Trends in Information, Telecommunication and ComputingNew York)  		2012. Springer. p. .  	 
\bibitem[Zhong and Yue (2010)]{b64}\label{b64} 	 		‘DDoS detection system based on data mining’.  		 			R Zhong 		,  		 			G Yue 		.  	 	 		\textit{Proceedings of the 2nd International Symposium on Networking and Network Security},  				 (the 2nd International Symposium on Networking and Network SecurityJinggangshan, China)  		2-4 April. 2010. Academy Publisher. p. .  	 
\bibitem[Ranjan and Swaminathan ()]{b8}\label{b8} 	 		‘DDoS-Resilient Scheduling to Counter Application Layer Attacks under Imperfect Detection’.  		 			S Ranjan 		,  		 			. R M Swaminathan 		,  		 			KnightlyE 		.  	 	 		\textit{IEEE INFOCOM'06},  				2006.  	 
\bibitem[Saifullah ()]{b21}\label{b21} 	 		\textit{Defending against distributed denial-of-service attacks with weight-fair router throttling},  		 			A M Saifullah 		.  		 2009-7.  		2009. St. Louis, USA.  		 			Computer Science and Engineering, Washington University 		 	 	 (Technical Report) 
\bibitem[Chang ()]{b9}\label{b9} 	 		‘Defending against flooding-based distributed denial of service attacks: A tutorial’.  		 			R K C Chang 		.  	 	 		\textit{Computer Journal. IEEE Communication Magazine}  		2002. 40  (10)  p. .  	 
\bibitem[Denial of Service Attacks (2001)]{b12}\label{b12} 	 		\textit{Denial of Service Attacks},  		 \url{http://www.cert.org/techtips/denialofservice.html}  		June 4, 2001.  		 			CERT 		 	 
\bibitem[Akella et al.]{b31}\label{b31} 	 		‘Detecting DDoS attacks on ISP networks’.  		 			A Akella 		,  		 			M Bharambe 		,  		 			M Reiter 		,  		 			S Seshan 		.  	 	 		\textit{Proceedings of the Workshop on Management and Processing of Data Streams},  				 (the Workshop on Management and Processing of Data StreamsSan Diego, CA, 8)  		 	 
\bibitem[Peng et al. (2004)]{b22}\label{b22} 	 		‘Detecting distributed denial of service attacks using source IP address" monitoring’.  		 			T Peng 		,  		 			C Leckie 		,  		 			K Rao 		.  	 	 		\textit{Proceedings of the 3rd International IFIP-TC6 Networking Conference},  				 (the 3rd International IFIP-TC6 Networking ConferenceAthens, Greece)  		May. 2004. Springerverlag. p. .  	 
\bibitem[Jalili et al. (2005)]{b37}\label{b37} 	 		‘Detection of distributed denial of service attacks using statistical pre-processor and unsupervised neural networks’.  		 			R Jalili 		,  		 			F Imani-Mehr 		,  		 			M Amini 		,  		 			H R Shahriari 		.  	 	 		\textit{Proceedings of the International conference on information security practice and experience},  				 (the International conference on information security practice and experienceSingapore)  		2005. April. Springer-verlag. p. .  	 
\bibitem[K Munivara Prasad et al. (2013)]{b14}\label{b14} 	 		‘Discrimination of Flash crowd attacks from DDoS attacks on internet threat monitoring (ITM) using Entropy variations’.  		 			Dr K Munivara Prasad 		,  		 			Dr K Venugopal Rama Mohan Reddy 		,  		 			Rao 		.  	 	 		\textit{IEEE African Journal of Computing \& ICT}  		June 2013. 6  (2)  p. .  	 
\bibitem[Chen et al.]{b18}\label{b18} 	 		‘Distributed change-point detection of DDoS attacks over multiple network domains’.  		 			Y Chen 		,  		 			, Hwang 		,  		 			W S Ku 		.  	 	 		\textit{Proceedings of the IEEE International Symposium on Collaborative Technologies and Systems},  				 (the IEEE International Symposium on Collaborative Technologies and SystemsLas Vegas, NV)  		p. .  	 
\bibitem[Kumar and Selvakumar ()]{b43}\label{b43} 	 		‘Distributed denial of service attack detection using an ensemble of neural classifier’.  		 			P Kumar 		,  		 			S Selvakumar 		.  		 1328-1341..  	 	 		\textit{Computer Communication}  		2011. 34.  	 
\bibitem[Todd (2000)]{b11}\label{b11} 	 		\textit{Distributed Denial of Service Attacks},  		 			B Todd 		.  		 \url{http://www.linuxsecurity.com/resourcefiles/intrusiondetection/ddos-whitepaper.html}  		Feb. 18, 2000.  	 
\bibitem[Limwiwatkul and Rungsawang]{b49}\label{b49} 	 		‘Distributed denial of service detection using TCP/IP header and traffic measurement analysis’.  		 			L Limwiwatkul 		,  		 			A Rungsawang 		,  		 			A 		.  	 	 		\textit{Proceedings of the IEEE International Symposium Communications and Information Technology},  				 (the IEEE International Symposium Communications and Information TechnologySapporo, Japan)  		p. .  	 
\bibitem[Criscuolo (2000)]{b6}\label{b6} 	 		‘Distributed Denial of Service, Tribe Flood Network 2000, and Stacheldraht CIAC-2319’.  		 			P J Criscuolo 		.  		 ID-136939.  	 	 		\textit{Rev}  		February 14, 2000. 1.  		 			Department of Energy Computer Incident Advisory Capability (CIAC ; Lawrence Livermore National Laboratory 		 	 
\bibitem[Wu et al. ()]{b40}\label{b40} 	 		‘DoS detection and traceback with decision tree and grey relational analysis’.  		 			Y Wu 		,  		 			H R Tseng 		,  		 			W Yang 		,  		 			Jan 		,  		 			R 		.  	 	 		\textit{International Journal of Ad Hoc and Ubiquitous Computing}  		2011. 7 p. .  	 
\bibitem[Chang-Lung et al. ()]{b36}\label{b36} 	 		‘Early Warning System for DDoS Attacking Based on Multilayer Deployment of Time Delay Neural Network’.  		 			T Chang-Lung 		,  		 			A Y Chang 		,  		 			Ming Szu 		,  		 			H 		.  	 	 		\textit{Proceedings of IEEE 6th International Conference on Intelligent Information Hiding and Multimedia Signal Processing (IIH-MSP)},  				 (IEEE 6th International Conference on Intelligent Information Hiding and Multimedia Signal Processing (IIH-MSP))  		2010. p. .  	 
\bibitem[Xia et al. ()]{b74}\label{b74} 	 		‘Enhancing DDoS flood attack detection via intelligent fuzzy logic’.  		 			Z Xia 		,  		 			S Lu 		,  		 			J Li 		,  		 			J Tang 		.  		 pages-497-507..  	 	 		\textit{Informatics (Slovenia)}  		2010. 34.  	 
\bibitem[Agarwal et al. ()]{b35}\label{b35} 	 		‘Estimating Strength of a DDoS Attack in Real Time Using ANN Based Scheme’.  		 			P K Agarwal 		,  		 			B Gupta 		,  		 			S Jain 		,  		 			M K Pattanshetti 		.  	 	 		\textit{Communications in Computer and Information Science}  		2011. Springer. 157 p. .  	 
\bibitem[Agrawal and Srikant (1994)]{b65}\label{b65} 	 		‘Fast algorithms for mining association rules in large databases’.  		 			R Agrawal 		,  		 			R Srikant 		.  	 	 		\textit{Proceedings of the 20th International Conference on Very Large Data Bases},  				 (the 20th International Conference on Very Large Data BasesSantiago de Chile, Chile)  		September. 1994. Morgan Kaufmann. p. .  	 
\bibitem[Francois et al. ()]{b60}\label{b60} 	 		‘Fire Col: A collaborative protection network for the detection of flooding DDoS attacks’.  		 			J Francois 		,  		 			I Aib 		,  		 			R Boutaba 		.  		 1828-1841..  	 	 		\textit{IEEE/ACM Transaction on Networking}  		2012. 20.  	 
\bibitem[Zhang et al. ()]{b75}\label{b75} 	 		\textit{Flow level detection and filtering of low-rate DDoS. Computer Networks},  		 			C Zhang 		,  		 			Z Cai 		,  		 			W Chen 		,  		 			X Luo 		,  		 			Yin 		,  		 			J 		.  		2012. 56 p. .  	 
\bibitem[Rahmani and Sahli (2009)]{b57}\label{b57} 	 		‘Joint entropy analysis model for DDoS attack detection’.  		 			H Rahmani 		,  		 			N Sahli 		,  		 			Kammoun 		,  		 			F 		.  	 	 		\textit{Proceedings of the 5th International Conference on Information Assurance and Security},  				 (the 5th International Conference on Information Assurance and SecurityXian, China)  		18-20 August. 2009. 02 p. .  	 
\bibitem[K Munivara Prasad and Rama Mohan Reddy (2012)]{b15}\label{b15} 	 		 			Dr K Munivara Prasad 		,  		 			Rama Mohan Reddy 		.  		\textit{IP Traceback for Flooding attacks on Internet Threat Monitors (ITM ) Using Honeypots , International journal of Network Security \& Its Applications (IJNSA)},  				Jan 2012. 4 p. .  	 
\bibitem[Sekar et al. (2006)]{b56}\label{b56} 	 		‘LADS: large-scale automated DDoS detection system’.  		 			V Sekar 		,  		 			N Dueld 		,  		 			O Spatscheck 		,  		 			J Van Der Merwe 		,  		 			H Zhang 		.  	 	 		\textit{Proceedings of the annual conference on USENIX Annual Technical Conference},  				 (the annual conference on USENIX Annual Technical ConferenceBoston, MA)  		30 May-3 June. 2006. USENIX Association. p. .  	 
\bibitem[Gilad and Herzberg ()]{b26}\label{b26} 	 		‘LOT: A defense against IP spoofing and flooding attacks’.  		 			Y Gilad 		,  		 			A Herzberg 		,  		 			A 		.  	 	 		\textit{ACM Transaction on Information. Systems. Se}  		2012. 15.  	 
\bibitem[Xiang and Li ()]{b16}\label{b16} 	 		‘Low-rate DDoS attacks detection and traceback by using new information metrics’.  		 			Y Xiang 		,  		 			K Li 		,  		 			Zhou 		.  	 	 		\textit{IEEE Transaction on Information Forensics}  		2011. 6 p. .  	 
\bibitem[Xiang et al. ()]{b58}\label{b58} 	 		‘Low-rate DDoS attacks detection and traceback by using new information metrics’.  		 			Y Xiang 		,  		 			K Li 		,  		 			W Zhou 		.  	 	 		\textit{IEEE Transactions on Information Forensics and Security}  		2011. 6 p. .  	 
\bibitem[Xiang et al. ()]{b81}\label{b81} 	 		‘Low-rate DDoS attacks detection and traceback by using new information metrics’.  		 			Y Xiang 		,  		 			K Li 		,  		 			W Zhou 		.  	 	 		\textit{IEEE T Inf. Foren. Sec}  		2011. 6 p. .  	 
\bibitem[K Munivara Prasad and Rama Mohan Reddy (2011)]{b42}\label{b42} 	 		‘Modelling and Counter measures of Flooding attacks to ITM using Botnet and Group Testing’.  		 			Dr K Munivara Prasad 		,  		 			Rama Mohan Reddy 		.  	 	 		\textit{Global journal of Computer Science and Technology}  		Dec 2011. GJCST. 21 p. .  	 
\bibitem[Gil and Poletto (2001)]{b45}\label{b45} 	 		‘MULTOPS: a datastructure for bandwidth attack detection’.  		 			T M Gil 		,  		 			M Poletto 		.  	 	 		\textit{Proceedings of the 10th conference on USENIX Security Symposium},  				 (the 10th conference on USENIX Security SymposiumBerkeley, CA, USA)  		August 3. 2001. 10 p. .  	 
\bibitem[Thomas et al. (2003)]{b46}\label{b46} 	 		‘Net Bouncer: Client-legitimacy-based highperformance DDoS filtering’.  		 			R Thomas 		,  		 			B Mark 		,  		 			T Johnson 		,  		 			J Croall 		,  		 			Usa Ieee Cs 		.  	 	 		\textit{Proceedings of the 3rd DARPA Information Survivability Conference and Exposition},  				 (the 3rd DARPA Information Survivability Conference and ExpositionWashington, DC)  		April. 2003. p. .  	 
\bibitem[Hwang et al. (2003)]{b53}\label{b53} 	 		‘Net Shield: Protocol anomaly detection with datamining against DDoS attacks’.  		 			K Hwang 		,  		 			P Dave 		,  		 			S Tanachaiwiwat 		.  	 	 		\textit{Proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection},  				 (the 6th International Symposium on Recent Advances in Intrusion DetectionPittsburgh, PA)  		8-10 September. 2003. Springer-verlag. p. .  	 
\bibitem[Nguyen and Choi ()]{b41}\label{b41} 	 		‘Proactive detection of DDoS attacks utilizing k-NN classifier in an Anti-DDoS framework’.  		 			H Nguyen 		,  		 			Y Choi 		.  	 	 		\textit{International Journal of Electrical}  		2010. 4 p. .  	 	 (Computer, and Systems Engineering) 
\bibitem[Loukas and Oke ()]{b2}\label{b2} 	 		‘Protection against denial of service attacks: A survey’.  		 			G Loukas 		,  		 			¨g Oke 		.  		 1020-1037..  	 	 		\textit{Computer. Journal}  		2010. 53.  	 
\bibitem[Shiaeles et al. ()]{b27}\label{b27} 	 		‘Real time DDoS detection using fuzzy estimators’.  		 			S N Shiaeles 		,  		 			V Katos 		,  		 			A Karakos 		,  		 			B K Papadopoulos 		.  	 	 		\textit{Computer. Security}  		2012. 31 p. .  	 
\bibitem[Gavrilis ()]{b39}\label{b39} 	 		‘Real-time detection of distributed denial-of-service attacks using RBF networks and statistical features’.  		 			D Gavrilis 		,  		 			Dermatas 		,  		 			E 		.  	 	 		\textit{Computer Networks and ISDN Systems},  				2005. 48 p. .  	 
\bibitem[Wu et al. ()]{b52}\label{b52} 	 		‘Robust and efficient detection of DDoS attacks for large-scale internet’.  		 			D Wu 		,  		 			K Lu 		,  		 			J Fan 		,  		 			S Todorovic 		,  		 			Nucci 		.  	 	 		\textit{Computer Networks}  		2007. 51 p. .  	 
\bibitem[Udhayan and Hamsapriya ()]{b24}\label{b24} 	 		‘Statistical segregation method to minimize the false detections during DDoS attacks’.  		 			J Udhayan 		,  		 			T Hamsapriya 		.  	 	 		\textit{International Journal of Network Security}  		2011. 13 p. .  	 
\bibitem[Peng et al. ()]{b0}\label{b0} 	 		‘Survey of network-based defense mechanisms countering the DoS and DDoS problems’.  		 			T Peng 		,  		 			C Leckie 		,  		 			K Rmrao 		.  	 	 		\textit{ACM Computing Survey}  		2007. 39 p. .  	 
\bibitem[Bhuyan et al. ()]{b3}\label{b3} 	 		‘Surveying port scans and their detection methodologies’.  		 			M H Bhuyan 		,  		 			D K Bhattacharyya 		,  		 			J K Kalita 		.  	 	 		\textit{Computer. Journal}  		Pages-1565-1581. ,(2011. 54.  	 
\bibitem[Yu et al. ()]{b80}\label{b80} 	 		‘Traceback of DDoS Attacks Using Entropy Variations’.  		 			S Yu 		,  		 			W Zhou 		,  		 			R Doss 		,  		 			W Jia 		.  	 	 		\textit{IEEE Transactions on Parall. Distr}  		2011. 22 p. .  	 
\bibitem[Kumar et al. ()]{b79}\label{b79} 	 		‘Traceback Techniques Against DDoS Attacks: A Comprehensive Review’.  		 			K Kumar 		,  		 			A L Sangal 		,  		 			A Bhandari 		.  	 	 		\textit{Proceedings of IEEE 2nd International Conference on Computer and Communication Technology (ICCCT)},  				 (IEEE 2nd International Conference on Computer and Communication Technology (ICCCT))  		2011. p. .  	 
\bibitem[Subhashini and Subbalakshmi ()]{b83}\label{b83} 	 		‘Tracing sources of DDoS attacks in IP networks using machine learning automatic defence system’.  		 			K Subhashini 		,  		 			G Subbalakshmi 		.  	 	 		\textit{International. Journal. Electron. Commun. Comput. Eng}  		2012. 3 p. .  	 
\bibitem[Lipson ()]{b82}\label{b82} 	 		‘Tracking and Tracing Cyber-Attacks: Technical Challenges and Global Policy Issues’.  		 			H F Lipson 		.  		 Report: CMU/SEI-2002-SR-009.  	 	 		\textit{CERT Coordination Center}  		2002.  	 
\bibitem[Liu and Cukic ()]{b33}\label{b33} 	 		‘Validating neural network-based online adaptive systems: A case study’.  		 			Y Liu 		,  		 			B Cukic 		,  		 			Gururajan 		,  		 			S 		.  	 	 		\textit{Software Quality. Jounal}  		2007. 15 p. .  	 
\bibitem[Haar ()]{b68}\label{b68} 	 		‘Zur "Theoriederorthogonalen Funktionensysteme’.  		 			A Haar 		,  		 			A 		.  	 	 		\textit{Mathematische Annalen}  		1910. 69 p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
