Frequency characteristics of DoS and DDoS attacks

Abstract

Denial of Service (DoS) and Distributed Denial of service (DDoS) attacks are common place in today's computer networks. There are different types of attacks among which Flood based attacks are the major ones. Attacks detection mechanisms usually rely on statistical information of the traffic. As regards of the fact that statistical properties of DoS and DDoS attacks are very similar to those in legitimate traffics, in this paper we characterize the frequency domain of denial of service attacks instead of time domain. We consider the number of packets arriving to the node of victim as a random process which is acquired by sampling the packets number every 1 milli-second. Having created the process we find the normalized spectrum of the sampled data. The results show that the main energy of DoS and DDoS attacks are distributed in high and low frequencies respectively while energy is spread evenly through all range of frequencies in Normal TCP traffic.