A New Set of Features for Detecting Router Advertisement Flooding Attacks

ICMPv6 is vulnerable to a set of attacks that contributes to preventing IPv6 from being trusted for full implementations on today's networks. One of these attacks is Router Advertisement (RA) flooding attack by sending a huge traffic toward a victim to consume its resources and stop its services. To detect these attacks, classification processes are applied based on a set of features used to represent the network traffic. This paper proposes a set of representative features depends on a suitable formation of data using a flow representation of the traffic. The proposed features and representation have achieved an acceptable detection ability of the RA flooding attacks using several classification techniques. Moreover, the achieved detection ability might be further improved by extracting more representative features or selecting a subset of them to represent the traffic.