Notes

survey focuses on
zombie detection and counteractive action,
attack graph development and security investigation,
and programming characterized systems for attack countermeasures

to avert dos, sys admins need high accuracy in ddos detection.

[Freiling et al, 2005] proposes a simple approach to (distributed) DoS attack prevention that uses a honeypot to identify, infiltrate and analyze the remote control mechanism that controls the coordinated activity of botnets and to eventually annihilate the mechanism.

[Choi et al, 2007] proposes another botnet identification technique by monitoring DNS traffic, leveraging the fact that simultaneous DNS queries sent by distributed bots forms a group activity.

[Zeidanloo et al, 2010] establishes IDS as yet another approach of botnet detection.

ids is also used by wsn, as they need high security.

extensive work on attack and its purpose in recent times. Network intrusion detection study began as early as 1998 when [Staniford-Chen et al, 1996] led a DARPA-funded project and developed a graph based IDS.

[Garcia-Teodoro et al, 2009] extensively explores anomaly-based network intrusion detection and cites high cost and low detection rate as the limiting factor of this mechanism.

[Wang et al, 2004] provides an anomaly detector based on payload of network traffic.

[MS Koli and MK Chavan, 2017] [Al-Jarrah et al, 2016] addresses the shortcoming of payload-inspection-based IDS and standard Traffic-based IDS by proposing Traffic-based IDS build on RDPLM (randomized data partitioned learning model) that depends on features set, and techniques of feature selection, simplified sub spacing and multiple randomized meta-learning techniques.



[Freiling et al, 2005]: https://link.springer.com/chapter/10.1007%2F11555827_19
[Al-Jarrah et al, 2016]:
[MS Koli and MK Chavan, 2017]: http://ieeexplore.ieee.org/abstract/document/7975246/
[Choi et al, 2007]: ieeexplore.ieee.org/document/4385169/
[Zeidanloo et al, 2010]: http://ieeexplore.ieee.org/document/5563555/