Detect Low-rate Denial Of Service Attacks Research Articles

An LDoS attack detection method based on FSWT time–frequency distribution

The Low-rate Denial-of-Service (LDoS) attack is a stealthy and periodic attack, which belongs to the category of DoS attacks. The LDoS attack maliciously preempts and consumes target resources, causing the targeted network performance to decline and affecting the service quality. The LDoS attack is highly destructive and difficult to detect and defend against due to its abnormal attack behavior. In this paper, we discuss the network traffic behavior in the time domain, frequency domain, and time–frequency domain, and we find that the time–frequency domain contains more detailed information than the time domain and frequency domain alone. Considering the limitations of the existing time–frequency domain transformation methods, an LDoS attack detection method based on Frequency Slice Wavelet Transformation (FSWT) is presented in this paper. The entropy, ratio of energy, contrast, and correlation are extracted from the time–frequency distribution to depict the network traffic, and a decision tree is trained to detect the LDoS attack in this paper. According to the experimental results on NS2, testbed, and the comparative experiment, we conclude that the method presented in this paper performs well.

ERT-EDR: Online defense framework for TCP-targeted LDoS attacks in SDN

The Low-rate denial of service (LDoS) attack is a variant of denial of service (DoS) attack that exploits low overhead to render target services unreachable for legitimate users. Unlike legacy networks, software-defined networking (SDN) separates the behavior of controlling and forwarding, providing excellent programmability to achieve real-time defense against LDoS attacks. Leveraging the potential of SDN’s programmability, we propose a real-time anomaly defense framework tailored for SDN, named ERT-EDR. This framework is capable of detecting and mitigating TCP-targeted LDoS Attacks and comprises three modules: (1) The Information Collection Module. It periodically samples the traffic statistics for analysis. (2) The LDoS Attack Detection Module. It combines six features of traffic statistics and utilizes the Extremely Randomized Trees (ERT) algorithm to detect. (3) LDoS Attack Mitigation Module. It locates attacked ports with the Edit Distance on Real sequence (EDR) algorithm and installs flow table entries to filter attack traffic.Extensive experiments are conducted under various background traffic scenarios to validate the effectiveness and scalability of ERT-EDR. The results demonstrate that ERT-EDR can effectively detect TCP-targeted LDoS attacks with 96.4667% accuracy and 96.4977% F1score. Furthermore, it accurately identifies the attacked port and successfully mitigates attacks.

PeakSAX: Real-Time Monitoring and Mitigation System for LDoS Attack in SDN

Software-Defined Networking (SDN) is a new paradigm that facilitates network management by enabling programmability and disassociating the control plane from the data plane. SDN places the control plane into one or more controllers that take charge of the entire network. However, the logically centralized controller of SDN makes it subject to some security issues. Denial-of-Service (DoS) attacks are the main threat to SDN that can lead to impaired performance of the entire network. Low-rate Denial-of-Service (LDoS) attack is a variant of DoS attacks with a lower average attack rate and high concealability which is difficult to identify with traditional DDoS/DoS attack detection mechanisms. Additionally, existing LDoS attack detection and defense mechanisms often have weak real-time performance. To address this issue, we propose in this paper PeakSAX, a novel framework that can protect SDN against LDoS attacks in real-time by (1) Attack monitoring, (2) Traffic symbolization, (3) Malicious traffic identifying, (4) Attacker location, and (5) Mitigation strategy deployment. Simulation results show that PeakSAX can quickly identify and mitigate the impact of LDoS attacks about 4s, which improves over 70% compared to existing solutions.

A Detection and Mitigation Scheme of LDoS Attacks via SDN Based on the FSS-RSR Algorithm

Software-defined networking (SDN) is a new network architecture that separates the data plane from the control plane and provides network programmability, dynamic deployment, and management of network traffic. However, its security also faces many threats, such as low-rate denial of service (LDoS) attacks. The LDoS attack can use the vulnerability of the TCP congestion control mechanism on the network and requires only a small amount of attack data to achieve the attack effect, which make it harder to detect and mitigate than traditional DoS attacks. In this paper, we propose an LDoS attack detection and mitigation scheme. Our detection scheme collects the features of network traffic and uses the FSS-RSR algorithm to detect LDoS attacks in real time. Our mitigation scheme monitors traffic fluctuations to locate attack source IP addresses and delivers traffic rules to mitigate attacks. The experimental results show that our scheme has high accuracy and low complexity for LDoS attack detection, and a short response time for LDoS attack mitigation of fewer than 8 seconds.

A Method for Detecting LDoS Attacks in SDWSN Based on Compressed Hilbert–Huang Transform and Convolutional Neural Networks

Currently, Low-Rate Denial of Service (LDoS) attacks are one of the main threats faced by Software-Defined Wireless Sensor Networks (SDWSNs). This type of attack uses a lot of low-rate requests to occupy network resources and hard to detect. An efficient detection method has been proposed for LDoS attacks with the features of small signals. The non-smooth small signals generated by LDoS attacks are analyzed employing the time–frequency analysis method based on Hilbert–Huang Transform (HHT). In this paper, redundant and similar Intrinsic Mode Functions (IMFs) are removed from standard HHT to save computational resources and to eliminate modal mixing. The compressed HHT transformed one-dimensional dataflow features into two-dimensional temporal–spectral features, which are further input into a Convolutional Neural Network (CNN) to detect LDoS attacks. To evaluate the detection performance of the method, various LDoS attacks are simulated in the Network Simulator-3 (NS-3) experimental environment. The experimental results show that the method has 99.8% detection accuracy for complex and diverse LDoS attacks.

Real-Time Detection and Mitigation of LDoS Attacks in the SDN Using the HGB-FP Algorithm

The software-defined network (SDN) has created the conditions for the optimization and development of network structures. However, its architecture is still not sufficient to resist or identify all denial of service (DoS) attacks, such as low-rate DoS (LDoS) attacks. Due to their low transporting rate and flash-crowd-like nature, LDoS attacks are well hidden in the background traffic and difficult to identify by anti-DoS mechanisms in the SDN. By implementing LDoS attacks in the SDN, we confirm that they can severely degrade the quality of service. We further propose a framework based on the histogram-based gradient boosting and finding peaks (HGB-FP) algorithm to detect LDoS attacks and mitigate their influence in the SDN in real-time. The histogram-based gradient boosting (HGB) algorithm, an ensemble learning with high quality and low complexity, can identify LDoS attacks quickly and accurately. The finding peaks (FP) algorithm locates the attacker via peak properties of the flow and installs flow rules on the switches to drop the attack flows. Experiments prove that our framework has higher accuracy and F-measure in identifying LDoS attacks than other machine learning approaches and mitigates the impact of LDoS attacks on bottleneck links in the SDN within seconds on average.

Low-Rate Denial-of-Service Attack Detection: Defense Strategy Based on Spectral Estimation for CV-QKD

Although continuous-variable quantum key distribution (CVQKD) systems have unconditional security in theory, there are still many cyber attacking strategies proposed that exploit the loopholes of hardware devices and algorithms. At present, few studies have focused on attacks using algorithm vulnerabilities. The low-rate denial-of-service (LDoS) attack is precisely an algorithm-loophole based hacking strategy, which attacks by manipulating a channel’s transmittance T. In this paper, we take advantage of the feature that the power spectral density (PSD) of LDoS attacks in low frequency band is higher than normal traffic’s to detect whether there are LDoS attacks. We put forward a detection method based on the Bartlett spectral estimation approach and discuss its feasibility from two aspects, the estimation consistency and the detection accuracy. Our experiment results demonstrate that the method can effectively detect LDoS attacks and maintain the consistency of estimation. In addition, compared with the traditional method based on the wavelet transform and Hurst index estimations, our method has higher detection accuracy and stronger pertinence. We anticipate our method may provide an insight into how to detect an LDoS attack in a CVQKD system.

Performance and Features: Mitigating the Low-Rate TCP-Targeted DoS Attack via SDN

Software-Defined Networking (SDN) is an emerging network architecture. The decoupled data and control plane provides programmability for efficient network management. However, the centralized control mode of SDN also exposes unique vulnerabilities. Low-rate Denial of Service (LDoS) has a lower attack rate than ordinary DDoS attacks with the characteristics of periodicity and concealment, which is among one of the severe threats to SDN. In this paper, we propose a lightweight, real-time framework Performance and Features (P&F) to detect and mitigate LDoS attacks with SDN. We implement LDoS attacks in SDN, extract traffic features with OpenFlow, and classify the features into two categories. By analyzing the performance (P) of normal traffic under attack state, P&F determines whether LDoS attacks take effect based on machine learning. Meanwhile, P&F tries to locate attack sources and victims according to flow features (F) of LDoS attacks based on time-frequency analysis. According to detection and locating results, P&F sets corresponding mitigation schemes. Experimental results show that P&F has a high detection rate and low false positive rate for detecting LDoS attacks. P&F can deploy on controllers to achieve real-time attack detection and mitigation with low system cost, which can defend against LDoS attacks effectively.

ADMS: An online attack detection and mitigation system for LDoS attacks via SDN

Low-rate Denial of Service (LDoS) attacks cause severe destructiveness to network security. Consequently, the implementation of detection and defense against them is a concern among the research communities. But it is formidable to deploy extension modules to detect and mitigate attacks online in traditional networks, because devices are deficient of flexibility and scalability. To address the problem, we design and implement an online attack detection and mitigation system (ADMS) framework via the scalable and programmable Software Defined Networking (SDN). ADMS is installed on SDN controllers and conforms to the OpenFlow policy without extra devices. ADMS consists of two modules: the two-phase detection module and the mitigation module. The two-phase detection module combines the new port traffic feature and the Lightgbm classifier based on flow table statistics traffic to precisely detect LDoS attacks. The mitigation module utilizes the novel Sequence Matching based Dynamic Series Analysing (SMDSA) algorithm to locate the attacker, and efficiently mitigates attack traffic by packet filter. The SMDSA algorithm distinguishes the victim port from benign ports by calculating the anomaly score of each port. Our evaluation on a prototype implementation of ADMS shows that the framework is able to precisely identify and efficiently mitigate LDoS attacks in real-time.

LDoS attack detection method based on traffic classification prediction

Aiming at the low rate and strong concealment of low-rate Denial of Service (LDoS) attacks, the calculation of traffic Hurst index is combined with traffic classification, and a machine learning LDoS attack detection method based on search sorting is proposed. The method first calculates the segmentation Hurst exponent of each flow, and constructs a traffic similarity matrix as a statistical feature. Then, using the improved model XGBoost of the Gradient Boosting Decision Tree (GBDT), the traffic is classified and predicted. The network angle distinguishes between normal traffic and abnormal Origin-Destination (OD) flows containing LDoS attacks, thereby achieving the purpose of detecting LDoS attacks. The method in this study was validated using the US public network dataset Abilene. The experimental results show that the global LDoS attack traffic detection method based on the Hurst index and GBDT algorithm achieves better detection results under different attack rates.

Low-rate DoS attack detection method based on hybrid deep neural networks

Low-rate Denial of Service (LDoS) attacks use the low-rate requests to achieve the occupation of the network resources and have strong concealment. The traditional signal analysis based detection methods are challenging to detect LDoS attacks in the fluctuating legitimate traffic. In this paper, an LDoS attack detection method based on hybrid deep neural networks is proposed using one-dimensional convolutional neural network and gated recurrent unit. In order to evaluate the proposed detection method in the real scenarios, we captured real legitimate traffic from a website in the datacenter, and carried out a variety of real LDoS attacks on the mirror of the website in the laboratory environment to obtain real attack traffic. The detection results on the real traffic show that the proposed detection method does not need to extract features manually and can effectively detect LDoS attacks in fluctuating HTTP traffic with an average detection rate of 98.68%, which is more advantageous than MF-DFA or power spectral density based detection methods.

Coherent Detection of Synchronous Low-Rate DoS Attacks

Low-rate denial-of-service (LDoS) attacks are characterized by low average rate and periodicity. Under certain conditions, the high concealment of LDoS attacks enables them to transfer the attack stream to the network without being detected at all before the end. In this article, plenty of LDoS attack traffic is spread to the victim end to detect LDoS attacks. Through experimental analysis, it is found that the attack pulses at the victim end have sequence correlation, so the coherence detection technology in spread spectrum communication is proposed to detect LDoS attacks. Therefore, this paper proposes an attack detection method based on coherent detection, which adopts bivariate cyclic convolution algorithm. Similar to the generation of receiving terminal phase dry detection code in spread spectrum communication, we construct a local detection sequence to complete the extraction of LDoS attack stream from the background traffic of the victim terminal, that is, the coherent detection of LDoS attacks. When predicting the features of an LDoS attack, how to construct the parameters of the detection sequence (such as period, pulse duration, amplitude, and so on) is very important. In this paper, we observe the correlation of LDoS attacks and use coherence detection to detect LDoS attacks. By comparing calculated cross-correlation values with designed double threshold rules, the existence of attacks can be determined. The simulation platform and experiments show that this method has high detection performance.

Novel LDoS attack detection by Spark‐assisted correlation analysis approach in wireless sensor network

Low-rate denial of service (LDoS) attack is a special DoS attack type of wireless sensor network (WSN). Routing protocol is the critical component of the WSN. Routing flood attack is a novel LDoS attack pattern in WSN. However, the attack is difficult to be detected by traditional intrusion detection algorithm. A novel LDoS attack detection method based on big data and signal analysis is proposed. Hilbert–Huang Transform (HHT) time–frequency signal analysis method is used to analyse the small non-linear signal from LDoS attack traffic signal. Spark-based Pearson and Spearman correlation coefficient calculation approaches are used to recognise the false intrinsic mode functions (IMFs) components decomposed by the HHT method. The effective threshold value of Pearson correlation coefficient is set to 0.2, the effective threshold value of Spearman correlation coefficient is set to 0.3, which are united to identify the false IMF components. SunSpot wireless nodes are used to build the wireless sensor nodes. If the difference between the IMF component and the normal IMF component is more than 40%, the LDoS attack will be detected. Experimental results show that this approach is effective to detect the LDoS attack in ZigBee WSN. This is a quantitative LDoS attack detection experimental research in WSN.

Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis

Low-rate denial of service (LDoS) attacks send attacking bursts intermittently to the network which can severely degrade the victim system’s Quality of Service (QoS). The low-rate nature of such attacks complicates attack detection. LDoS attacks repeatedly trigger the congestion control mechanism, which can make TCP traffic extremely unstable. This paper investigates the network traffic’ characteristics, in which variance and entropy are used to evaluate the TCP traffic’s characteristics, and the ratio of UDP traffic to TCP traffic (UTR) is also analyzed. Thus, a detection method combining two-step cluster analysis and UTR analysis is proposed. Through two-step cluster analysis which is one of the machine learning algorithms, network traffic is divided into multiple clusters and then clusters subjected to LDoS attacks are determined using UTR analysis. NS2 simulation platform and test-bed network environment aim to evaluate the detection approach’s performance. To better assess the effectiveness of the method, public dataset WIDE is also utilized. Experimental results with a good performance prove that the proposed detection approach can accurately detect LDoS attacks.

MF-CNN: a New Approach for LDoS Attack Detection Based on Multi-feature Fusion and CNN

Low-rate denial-of-service (LDoS) attack reduce the performance of network services by periodically sending short-term and high-pulse packets. The behavior of LDoS attack is indistinguishable from normal traffic due to its low average rate. Many networks do not have an effective mechanism to deal with the threat from LDoS attack, including the emerging Internet of Things. When LDoS attack occurs, multiple features of network will change. It is difficult to describe the state of the whole network by one feature. So it needs many features to precisely represent the state of the network. In this paper, we propose a LDoS attack detection method based on multi-feature fusion and convolution neural network(CNN). In this method, we compute a variety of network features and fuse them into a feature map, which will be used to characterize the state of the network. CNN model is an excellent classification algorithm for image recognition in the field of deep learning. It can distinguish the difference between feature maps and detect the feature maps which contain LDoS attack. We validate and evaluate our method by conducting experiments on NS2 simulation platform and test-bed platform. The experimental results show that our method can detect LDoS attack effectively.

MF-Adaboost: LDoS attack detection based on multi-features and improved Adaboost

A low-rate denial of service (LDoS) attack is a precise network attack that aims at reducing the quality of the network service. Many networks do not have an effective mechanism for defending against LDoS attacks, including the emerging Internet of Things. In this paper, we propose an LDoS attack detection method that is based on multiple features of network traffic and an improved Adaboost algorithm (MF-Adaboost). Based on an analysis of the network traffic, we construct a network feature set that is used for feature calculation and feature selection of network traffic data. Feature calculation can extract the most useful information from the network traffic data and reduce the scale of the network data. Feature selection is used to select the optimal classification features to ensure that the detection algorithm can be effectively trained. This method utilizes the Adaboost algorithm, which is a classification algorithm in the field of machine learning. The well-trained Adaboost algorithm can effectively identify LDoS attack traffic. We improve the Adaboost algorithm to alleviate the imbalance of the sample weights. Experiments are conducted on the NS2 simulation platform and a test-bed platform to evaluate the performance of our method. The experimental results demonstrate that our method can detect LDoS attacks effectively.

Low-Rate DoS Attacks Detection Based on MAF-ADM.

Low-rate denial of service (LDoS) attacks reduce the quality of network service by sending periodical packet bursts to the bottleneck routers. It is difficult to detect by counter-DoS mechanisms due to its stealthy and low average attack traffic behavior. In this paper, we propose an anomaly detection method based on adaptive fusion of multiple features (MAF-ADM) for LDoS attacks. This study is based on the fact that the time-frequency joint distribution of the legitimate transmission control protocol (TCP) traffic would be changed under LDoS attacks. Several statistical metrics of the time-frequency joint distribution are chosen to generate isolation trees, which can simultaneously reflect the anomalies in time domain and frequency domain. Then we calculate anomaly score by fusing the results of all isolation trees according to their ability to isolate samples containing LDoS attacks. Finally, the anomaly score is smoothed by weighted moving average algorithm to avoid errors caused by noise in the network. Experimental results of Network Simulator 2 (NS2), testbed, and public datasets (WIDE2018 and LBNL) demonstrate that this method does detect LDoS attacks effectively with lower false negative rate.

Detecting LDoS attack bursts based on queue distribution

Low-rate denial of service (LDoS) attacks exploit the congestion control mechanism to degrade the network quality of service. As a classic active queue management algorithm, random early detection (RED) algorithm is widely used to avoid network congestion. However, RED is vulnerable to LDoS attacks. LDoS attacks with well-configured attack parameters force RED queue to fluctuate severely, thereby throttling transmission control protocol (TCP) senders' sending rate. A feedback control model is proposed to describe the process of the congestion control, by which the congestion window and queue behaviours are analysed combined. After that, a two-dimensional queue distribution model composed of the instantaneous queue and the average queue is designed to extract the attack feature. Moreover then, a combination of a simple distance-based approach and an adaptive threshold algorithm is proposed to detect every LDoS attack burst. Test results of network simulator (NS)-2 simulation and test-bed experiments indicate that the proposed detection strategy can almost completely detect LDoS attack bursts and is especially robust to legitimate short bursts.

Sequence alignment detection of TCP-targeted synchronous low-rate DoS attacks

TCP-targeted Low-rate Denial of Service (LDoS) attack launches periodic flows at a sufficiently low average rate that completely spread into large network traffic at the attack end. Hence, LDoS attack traffic has significant periodicity, low transmission rate, and wide distribution. This paper investigates the characteristics of LDoS attacks from a sequence matching perspective. Based on the analysis of sequence similarity between distributed LDoS attack pulses at the victim end, we find that the technique of sequence alignment detection in bioinformatics can be used to detect LDoS attack flows. We presented an approach of LDoS attack detection by using the Smith-Waterman local sequence alignment algorithm that obtaining the similarity score of two sequences. Through this approach, the locally constructed detection sequence is compared with the background flow, especially the three characteristics of the pulse period, length and amplitude of the constructed detection sequence are used as benchmarks to accurately estimate the characteristic parameters of the LDoS attack. A double threshold rule is designed and compared with the calculated maximum similarity score value. Thereby achieving the purpose of detecting an LDoS attack. We build a simulation platform and test-bed to validate the proposed approach. We designed the simulation platform and built the test-bed separately to test and verify the performances of the proposed approach. Experimental results show that this proposed approach has high accuracy and F1 score.

A Novel Low-Rate Denial of Service Attack Detection Approach in ZigBee Wireless Sensor Network by Combining Hilbert-Huang Transformation and Trust Evaluation

Low-rate Denial of Service (LDoS) attack is a special DoS attack. The routing protocol is vulnerable to many types of attacks in a wireless sensor network (WSN), which is an important network type of the Internet of Things (IoT). The novel LDoS attack to the routing protocol is proposed to evaluate the security and trust mechanism in the WSN. In fact, the LDoS attack is difficult to be detected due to its small-signal characteristics, so it is a serious threat to the security and trust of the WSN. A Hilbert-Huang transform (HHT) time-frequency joint analysis approach is utilized to analyze the non-stationary small signal that is produced by the LDoS attack. However, false intrinsic mode function (IMF) components are the challenge problems to precisely detect the LDoS attack. Correlation coefficient and Kolmogorov-Smirnov (KS) test approaches are united to evaluate the trustworthy of IMF components and exclude the false IMF components. Hilbert-Huang transformation and trust evaluation approaches are combined to detect the novel LDoS attack in Zigbee WSN. CC2530 system-on-chip integrated with ZigBee protocol is utilized to build a wireless sensor node. Random routing REQuest (RREQ) flooding attack is used to implement the routing layer LDoS attack in Zigbee WSN. If the correlation coefficient value of IMF component relative to original traffic is more than 0.3 and the KS similarity probability value of the IMF component relative to the original traffic is more than 0.4, the IMF component is identified as high trust IMF components that will be used to detect LDoS attack. If the IMF component only satisfies one of the trust evaluation conditions, the IMF component is identified as low trust IMF component. Otherwise, the IMF component is the false IMF component. We have proposed a scalable LDoS attack detection architecture for both WSN and IoT. The experimental results demonstrate that the novel approach is highly effective to detect the LDoS attack in the ZigBee WSN.