The Distributed Denial of Service Attacks Situation Awareness Based on The Prediction of Battle Scene Using Dempster-Shefer Evidences Theories and Bayesian Rules

The cyber battle scene has two main actors: attacker and defender. Attacker will reduce or interrupt the services that defender provides by continuously sending huge packets and defender will insist on continuing the services by apply various kinds of security methods. Evaluating this scene from the perspective of an observers can be ambiguous and the scene cannot be predictable. In this research, we have defined        different kinds of attacker and defender situations and expertise criteria including: capabilities, response time, tools, capability of continued defense and/or attack operations, and ultimately accessibility of         defender’s services. We used a dataset include 3003 sequence of attacker or defender situations for     measuring the above-mentioned criteria. The results show that half of the scene sequences have a short time, which means that the attacker takes advantage of surprising, the victims not being prepared for the attack. The correlation criteria show that prolonged time length of attack is to the benefit of attacker and the defender’s loss is increased. Also, the equipment does not have a positive effect on the response time of the attacker. This means that for the attacker skill is more effective than equipment. Then, in order to      predict the situation of battle scene four criteria of impact capacity were combined using the Evidences Dempster-Shefer Theory to predict the victim status and finally, we estimated future methods of attacker and defense strategies of defender by using the Dempster-Shefer Evidences Theory and Bayesian rules and showed using five scenarios in four stages that the reliability of our estimation is more than 65%.