• Journal of Internet Computing and Services
• /
• v.17 no.2
• /
• pp.19-28
• /
• 2016

Internet traffic has been significantly increasing due to the development of information and communication networks and the growing numbers of cell phone users that access networks. This paper connects to this issue by presenting a way to detect and analyze a typical DDoS attack that results in Internet breaches and network attacks, which are on the increase. To achieve this goal, we improve features and GUI of the existing ATMSim analysis package and use it. This package operates on a network flow-based analysis method, which means that normal traffic collected through an internal LAN at the Korean Bible University campus as well as anomaly traffic with DDoS attacks are generated. Self-similarity processes are used to analyze normal and anomaly traffic that are collected and generated from the improved ATMSim. Our numerical results obtained from three Hurst parameter estimate techniques show that there is quantitatively a significant difference between normal traffic and anomaly traffic from a self-similarity perspective.