Low-Rate DoS Attacks, Detection, Defense, and Challenges: A Survey

Wu Zhijun,Liu Liang,Yue Meng,Li Wenjing

doi:10.1109/access.2020.2976609

Abstract

Low-rate Denial of service (LDoS) attacks has become one of the biggest threats to the Internet, cloud computing platforms, and big data centers. As an evolutionary species of DDoS attack, LDoS attack is essentially different from the DDoS attack. DDoS attacks are the behavior of malicious blocking legitimate network traffic by destroying the targets and the infrastructure around it with huge network traffic. While, LDoS attacks are the behavior of intentional degrading the quality of TCP links by throttling TCP flows to a small fraction of its ideal rate with periodic small pulse sequence. Hence, LDoS attack has a very small flow (around 10%-20% of the background traffic), it is easy to eluding the detection of routers and counter-DoS mechanisms. We try to reveal the mechanism of the LDoS attack and attempt to figure out the generation principle of LDoS attack in this paper. We classify the LDoS attacks and existing defense methods according to time domain and frequency domain in which detection and defense are performed. Furthermore, we highlight the filter approach to defense against LDoS attack. The initial purpose of our work is to encourage researchers to study effective ways to detect and defend against LDoS attacks with innovation and aggressiveness.

Highlights

Distributed denial of service (DDoS) attacks have been raging for more than 20 years since it was reported on a large scale in 1998
This paper investigates the low-rate DoS attacks (LDoS) attack in large-scale network, with a focus on the classifications and scope of this kind attack and its detection and defense
According to our research results combined with existing research production, we can divide the detection types into three categories, which are feature detection methods, detection methods in frequency domain and time domain

Summary

Introduction

Distributed denial of service (DDoS) attacks have been raging for more than 20 years since it was reported on a large scale in 1998. DDoS attack has been very aggressive, extremely destructive, and has a huge impact. It is the favorite of cybercriminals and black industry chain operators. After more than 20 years of development, DDoS attacks have changed dramatically in both attack strength and intelligence. In the aspect of intelligence, DDoS attacks have evolved from simple, large (high-rate) traffic to smart, small (low-rate) flows. A new type of DoS attack came into being. This is low-rate DoS attacks (LDoS), which was first discovered on the Internet backbone network by Asta Networks monitored in 2001

Objectives

Methods

Conclusion