Statistical Analysis of Time Series for Port Scan and DDoS Detection

Аннотация

In this paper, statistical methodologies for time series analysis – specifically the Z-score and the modified Z-score – are examined in the context of detecting Port Scan and Distributed Denial of Service (DDoS) attacks. Six different time series were constructed using the following traffic characteristics: the average number of packets transmitted from sources to destinations, the data transfer rate, the response data transfer rate, the duration of the connection between the source and destination, the entropy computed based on destination ports associated with each IP source, and the number of unique destination ports available to each IP source. To evaluate the statistical methodologies under study, the indicators such as reliability, accuracy, response time, and F1-score were used. The obtained numerical results show that when detecting the network threats in question, the modified Z-score reduces the number of false positives compared to the Z-score standard, thereby influencing the evaluation of these performance metrics. The F1-scores achieved using the modified Z-score for DDoS detection ranged from 93% to 98%, depending on the specific traffic characteristics analyzed. Conversely, in the case of Port Scan detection, the F1-score did not exceed 58% even under optimal conditions. A comprehensive analysis showed that all the identified Port Scan instances refer to fast port scanning since this scanning method causes a sharp increase in network traffic. This phenomenon is manifested in a local violation of the stationarity of the time series. These findings were confirmed by Augmented Dickey-Fuller (ADF) and Kwiatkowski–Phillips–Schmidt–Shin (KPSS) statistical tests conducted to evaluate various hypotheses regarding the stationarity of the time series.