The distributed denial of service (DDoS) attack is one of the major threats to the current Internet. We propose a robust scheme to detect the distributed denial of service (DDoS) attack based on the essential DDoS attacks features, such as the abrupt traffic change, flow dissymmetry, distributed source IP addresses and concentrated target IP addresses. This paper proposes a IP Flow feature value (IFFV) algorithm that reflects the DDoS attack features, and uses a simple and efficient ARMA(2,1) IFFV prediction model for normal network flow based on linear prediction techniques. Then a DDoS attack detection scheme, DDDP (DDoS attacks detection based on IFFV Prediction), is designed for network flow. Furthermore, a mechanism evaluating the reliability of alert is developed to reduce the false alerts caused by prediction or flow noise. We have done experiments with the MIT Data Set in order to evaluate our method. The results show that DDDP is an efficient DDoS attacks detection scheme, which can quickly detect DDoS attacks accurately and reduce false alarm rate drastically.
