Widespread adoption of cloud computing has increased the attractiveness of such services to cybercriminals. Distributed denial of service (DDoS) attacks targeting the cloud’s bandwidth, services and resources to render the cloud unavailable to both cloud providers, and users are a common form of attacks. In recent times, feature selection has been identified as a pre-processing phase in cloud DDoS attack defence which can potentially increase classification accuracy and reduce computational complexity by identifying important features from the original dataset during supervised learning. In this work, we propose an ensemble-based multi-filter feature selection method that combines the output of four filter methods to achieve an optimum selection. We then perform an extensive experimental evaluation of our proposed method using intrusion detection benchmark dataset, NSL-KDD and decision tree classifier. The findings show that our proposed method can effectively reduce the number of features from 41 to 13 and has a high detection rate and classification accuracy when compared to other classification techniques.

Spoofing of IP is a key attribute of Distributed Denial of Service (DDoS) attack that consumes Cloud resources and network bandwidth within a short period of time. This is costly to both the providers and users of Cloud. Cloud computing offers a metered service, which uses pay-per use. Therefore providing a high available Cloud will improve the Cloud provider's reputation and financial proceeds. To the Cloud users, it solely depends on the provider for its resources therefore it must always be available as contained in the service level agreement (SLA). The goal of this paper is to analyse and compare the TCP/IP packet header features of incoming traffic that identifies remote hosts according to their Operating System. This is used to detect the true source of a packet during spoofed DDoS attack. Our solution further analyses the observed final TTL value in both active and passive stage of the OS fingerprints to cater for false negative during detection. We demonstrated our proposed solution on a Xen Cloud Platform Test bed.

Notwithstanding the increased popularity of cloud computing, Distributed Denial of Service (DDoS) remains a threat to its adoption. In this paper, we propose the use of a change-point monitoring algorithm to detect DDoS flooding attacks against cloud services by examining the packet inter-arrival time (IAT). This method leverages on the fact that most DDoS attacks are automated and exhibit similar patterns. These patterns, when closely examined, can be distinguished from normal traffic patterns, and can therefore be tracked using a cumulative sum (CUSUM) algorithm. The proposed solution was validated by conducting a trace-driven simulation and empirical evaluation. The results demonstrated the efficiency and accuracy of this proposed solution.

In this paper we investigate the performance of a transmit antenna selective multiple-input multiple-output (MIMO) (this is the proposed system), full complexity MIMO and single-input single-output (SISO) systems all operating under Weibull fading. The effect of increasing the number of antennas together with applying maximal-ratio combining (MRC) on the signal-to-noise ratio is studied. SNR is shown to increase with an increase in the number of antennas used, and this in turn increases the channel capacity. The system performance in terms of the channel capacity is also studied. We show that the average channel capacity can be increased by increasing the fading parameter. Increasing the fading parameter leads to a decrease in the severity of fading, meaning that signals can be decoded with reduced probability of error. We also show that the proposed transmit antenna selective MIMO and the full complexity MIMO systems outperform the single-input single-output (SISO) system in terms of channel capacity.