Low-rate DoS Attack Research Articles

From Seek-and-Destroy to Split-and-Destroy: Connection Partitioning as an Effective Tool against Low-Rate DoS Attacks

From Seek-and-Destroy to Split-and-Destroy: Connection Partitioning as an Effective Tool against Low-Rate DoS Attacks

Detecting and Mitigating Low-Rate DoS and DDoS Attacks: Multimodal Fusion of Time-Frequency Analysis and Deep Learning model

Detecting and Mitigating Low-Rate DoS and DDoS Attacks: Multimodal Fusion of Time-Frequency Analysis and Deep Learning model

A hybrid deep learning model based low‐rate DoS attack detection method for software defined network

AbstractThe low‐rate DoS (LDoS) attack is a new kind of network attack which has the characteristics such as low speed and good concealment. The software defined network, as a new type of network architecture, also faces the threat from LDoS attacks. In this article, we propose a detection method of LDoS attacks based on a hybrid deep learning model CNN‐GRU: the convolutional neural network (CNN) and the gated recurrent unit (GRU). First, we extract field values such as n_packets and n_bytes, from the flow rule, and construct the average numbers of packets and bytes as the input data of the hybrid model. Then, to enhance the detection performance of the hybrid model, we improve the sailfish algorithm to optimize the hyperparameters of CNN and GRU automatically in the training process. Finally, we adopt hyperparameter optimized CNN and GRU to extract deeper spatial and temporal features of input data, respectively, which achieves accurate detection of the LDoS attack. The experimental results demonstrate that the proposed hybrid deep learning model‐based method outperforms other traditional machine learning algorithms in terms of detection efficiency and accuracy.

Performance and Features: Mitigating the Low-Rate TCP-Targeted DoS Attack via SDN

Software-Defined Networking (SDN) is an emerging network architecture. The decoupled data and control plane provides programmability for efficient network management. However, the centralized control mode of SDN also exposes unique vulnerabilities. Low-rate Denial of Service (LDoS) has a lower attack rate than ordinary DDoS attacks with the characteristics of periodicity and concealment, which is among one of the severe threats to SDN. In this paper, we propose a lightweight, real-time framework Performance and Features (P&F) to detect and mitigate LDoS attacks with SDN. We implement LDoS attacks in SDN, extract traffic features with OpenFlow, and classify the features into two categories. By analyzing the performance (P) of normal traffic under attack state, P&F determines whether LDoS attacks take effect based on machine learning. Meanwhile, P&F tries to locate attack sources and victims according to flow features (F) of LDoS attacks based on time-frequency analysis. According to detection and locating results, P&F sets corresponding mitigation schemes. Experimental results show that P&F has a high detection rate and low false positive rate for detecting LDoS attacks. P&F can deploy on controllers to achieve real-time attack detection and mitigation with low system cost, which can defend against LDoS attacks effectively.

Low-rate DoS attack detection method based on hybrid deep neural networks

Low-rate Denial of Service (LDoS) attacks use the low-rate requests to achieve the occupation of the network resources and have strong concealment. The traditional signal analysis based detection methods are challenging to detect LDoS attacks in the fluctuating legitimate traffic. In this paper, an LDoS attack detection method based on hybrid deep neural networks is proposed using one-dimensional convolutional neural network and gated recurrent unit. In order to evaluate the proposed detection method in the real scenarios, we captured real legitimate traffic from a website in the datacenter, and carried out a variety of real LDoS attacks on the mirror of the website in the laboratory environment to obtain real attack traffic. The detection results on the real traffic show that the proposed detection method does not need to extract features manually and can effectively detect LDoS attacks in fluctuating HTTP traffic with an average detection rate of 98.68%, which is more advantageous than MF-DFA or power spectral density based detection methods.

A Table Overflow LDoS Attack Defending Mechanism in Software-Defined Networks

In order to achieve requirements such as fast search of flow entries and mask matching, OpenFlow hardware switches usually use TCAM to store flow entries. Limited by the capacity of TCAM, the current commercial OpenFlow switches can only support hundreds of thousands of flow entries, which makes SDN network using OpenFlow hardware switches vulnerable to the threat of flow table overflow attack. Among them, low-rate DoS (LDoS) attack against table overflow poses a serious threat to SDN networks due to its high attack efficiency and concealed flow, and it is also difficult to detect. In this regard, this paper analyzed two types of LDoS attack flow against table overflow and proposed an attack detection and defense mechanism named SAIA (Small-flow Analysis and Inport-flow Analysis) through the design of table overflow prediction and flow entries deletion strategy. Experiments conducted through the SDN network environment showed that SAIA can effectively detect and suppress LDoS attack flows in the flow table in large-scale network conditions and verified that the deployment of SAIA is lightweight. At the same time, SAIA implemented the flow entry deletion strategy based on LRU when the flow table overflows in a nonattack situation, which further enhances the stability of the network.

Detection of reduction-of-quality DDoS attacks using Fuzzy Logic and machine learning algorithms

Distributed Denial of Service (DDoS) attacks are still among the most dangerous attacks on the Internet. With the advance of methods for detecting and mitigating these attacks, crackers have improved their skills in creating new DDoS attack types with the aim of mimicking normal traffic behavior therefore becoming silently powerful. Among these advanced DDoS attack types, the so-called low-rate DoS attacks aim at keeping a low level of network traffic. In this paper, we study one of these techniques, called Reduction of Quality (RoQ) attack. To investigate the detection of this type of attack, we evaluate and compare the use of four machine learning algorithms: Multi-Layer Perceptron (MLP) neural network with backpropagation, K-Nearest Neighbors (K-NN), Support Vector Machine (SVM) and Multinomial Naive Bayes (MNB). We also propose an approach for detecting this kind of attack based on three methods: Fuzzy Logic (FL), MLP and Euclidean Distance (ED). We evaluate and compare the approach based on FL, MLP and ED to the above machine learning algorithms using both emulated and real traffic traces. We show that among the four Machine Learning algorithms, the best classification results are obtained with MLP, which, for emulated traffic, leads to a F1-score of 98.04% for attack traffic and 99.30% for legitimate traffic, while, for real traffic, it leads to a F1-score of 99.87% for attack traffic and 99.95% for legitimate traffic. Regarding the approach using FL, MLP and EC, for classification of emulated traffic, we obtained a F1-score of 98.80% for attack traffic and 99.60% for legitimate traffic, while, for real traffic, we obtained a F1-score of 100% for attack traffic and 100% for legitimate traffic. However, the better performance of the approach based on FL, MLP and ED is obtained at the cost of larger execution time, since MLP required 0.74 ms and 0.87 ms for classification of the emulated and real traffic datasets, respectively, where as the approach using FL, MLP and ED required 11’46” and 46’48” to classify the emulated and real traffic datasets, respectively.

Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis

Low-rate denial of service (LDoS) attacks send attacking bursts intermittently to the network which can severely degrade the victim system’s Quality of Service (QoS). The low-rate nature of such attacks complicates attack detection. LDoS attacks repeatedly trigger the congestion control mechanism, which can make TCP traffic extremely unstable. This paper investigates the network traffic’ characteristics, in which variance and entropy are used to evaluate the TCP traffic’s characteristics, and the ratio of UDP traffic to TCP traffic (UTR) is also analyzed. Thus, a detection method combining two-step cluster analysis and UTR analysis is proposed. Through two-step cluster analysis which is one of the machine learning algorithms, network traffic is divided into multiple clusters and then clusters subjected to LDoS attacks are determined using UTR analysis. NS2 simulation platform and test-bed network environment aim to evaluate the detection approach’s performance. To better assess the effectiveness of the method, public dataset WIDE is also utilized. Experimental results with a good performance prove that the proposed detection approach can accurately detect LDoS attacks.

Low-Rate DoS Attacks, Detection, Defense, and Challenges: A Survey

Low-rate Denial of service (LDoS) attacks has become one of the biggest threats to the Internet, cloud computing platforms, and big data centers. As an evolutionary species of DDoS attack, LDoS attack is essentially different from the DDoS attack. DDoS attacks are the behavior of malicious blocking legitimate network traffic by destroying the targets and the infrastructure around it with huge network traffic. While, LDoS attacks are the behavior of intentional degrading the quality of TCP links by throttling TCP flows to a small fraction of its ideal rate with periodic small pulse sequence. Hence, LDoS attack has a very small flow (around 10%-20% of the background traffic), it is easy to eluding the detection of routers and counter-DoS mechanisms. We try to reveal the mechanism of the LDoS attack and attempt to figure out the generation principle of LDoS attack in this paper. We classify the LDoS attacks and existing defense methods according to time domain and frequency domain in which detection and defense are performed. Furthermore, we highlight the filter approach to defense against LDoS attack. The initial purpose of our work is to encourage researchers to study effective ways to detect and defend against LDoS attacks with innovation and aggressiveness.

Sequence alignment detection of TCP-targeted synchronous low-rate DoS attacks

TCP-targeted Low-rate Denial of Service (LDoS) attack launches periodic flows at a sufficiently low average rate that completely spread into large network traffic at the attack end. Hence, LDoS attack traffic has significant periodicity, low transmission rate, and wide distribution. This paper investigates the characteristics of LDoS attacks from a sequence matching perspective. Based on the analysis of sequence similarity between distributed LDoS attack pulses at the victim end, we find that the technique of sequence alignment detection in bioinformatics can be used to detect LDoS attack flows. We presented an approach of LDoS attack detection by using the Smith-Waterman local sequence alignment algorithm that obtaining the similarity score of two sequences. Through this approach, the locally constructed detection sequence is compared with the background flow, especially the three characteristics of the pulse period, length and amplitude of the constructed detection sequence are used as benchmarks to accurately estimate the characteristic parameters of the LDoS attack. A double threshold rule is designed and compared with the calculated maximum similarity score value. Thereby achieving the purpose of detecting an LDoS attack. We build a simulation platform and test-bed to validate the proposed approach. We designed the simulation platform and built the test-bed separately to test and verify the performances of the proposed approach. Experimental results show that this proposed approach has high accuracy and F1 score.

Characterization of the Imaged R/S Pox Diagram for Low-rate DoS Attack

Characterization of the Imaged R/S Pox Diagram for Low-rate DoS Attack

Power spectrum entropy based detection and mitigation of low-rate DoS attacks

Low-Rate DoS (LDoS) attacks send periodical packet bursts to the bottleneck routers which can throttle the bandwidth of TCP flows. They are difficult to detect while severely degrading the Quality of Service (QoS) of TCP applications. By combining Power Spectrum Analysis with Information Entropy, we introduce two novel information metrics to detect the LDoS attacks: Fourier Power Spectrum Entropy (FPSE) and Wavelet Power Spectrum Entropy (WPSE). As the energy of LDoS attack signal is mostly concentrated in the low-frequency range, FPSE and WPSE of LDoS attacks both exhibit lower values compared to those of normal flows. Therefore, these two metrics can be applied here to detect LDoS attacks efficiently. By evaluating on NS-3 simulations and real network traces, the results validate the effectiveness of these two metrics to differentiate LDoS attacks from normal flows. They can detect the LDoS attacks efficiently with fewer false alarms compared to the other detection mechanisms. Based on these two metrics, we also propose a Power Spectrum Entropy-based Robust-RED (PRRED) queuing algorithm to mitigate LDoS attacks. The evaluation results in NS-3 demonstrate that the proposed algorithm is able to effectively preserve the TCP bandwidth while countering the different LDoS attacks.

Low-rate DoS attack flows filtering based on frequency spectral analysis

In frequency domain, the power spectrum of Low-rate denial of service (LDoS) attacks is totally spread into the spectrum of normal traffic. It is a challenging task to detect and filter LDoS attack flows from the normal traffic. Based on the analysis of LDoS attack flows and legitimate TCP traffic in time and frequency domains, the periodicity of the TCP traffic and LDoS attack flows is explored to facilitate the research of network traffic processing. Hence, an approach of LDoS attack flow filtering based on frequency spectrum analysis is proposed. In this approach, the TCP traffic and LDoS attack flows are transformed from the time domain into the frequency domain. Then the round-trip time (RTT) is estimated by using frequency domain search method. Analysis of amplitude spectrum shows that TCP traffic energy is mainly concentrated on the points of n/RTT. Therefore, a comb filter using infinite impulse response (IIR) filter is designed to filter out the LDoS attack flows in frequency domain, while most legitimate TCP traffic energy at the points of n/RTT are pass through. Experimental results show that the maximum pass rate for legitimate TCP traffic reaches 92.55%, while the maximum filtration rate of LDoS attack flows reaches 81.36%. The proposed approach can effectively filter the LDoS attack flows while less impact on the legitimate TCP traffic.

A Survey Paper on an On-Line Intrusion Detection Approach to Identify Low-Rate Dos Attacks

A Survey Paper on an On-Line Intrusion Detection Approach to Identify Low-Rate Dos Attacks

Modeling the Vulnerability of Feedback-Control Based Internet Services to Low-Rate DoS Attacks

Feedback control is a critical element in many Internet services (e.g., quality-of-service aware applications). Recent research has demonstrated the vulnerability of some feedback-control based applications to low-rate denial-of-service (LRDoS) attacks, which send high-intensity requests in an ON/OFF pattern to degrade the victim's performance and evade the detection designed for traditional DoS attacks. However, the intricate interaction between LRDoS attacks and the feedback control mechanism remains largely unknown. In this paper, we address two fundamental questions: 1) what is the impact of an LRDoS attack on a general feedback-control based system and 2) how to conduct a systematic evaluation of the impact of an LRDoS attack on specific feedback-control based systems. To tackle these problems, we model the system under attack as a switched system and then examine its properties. We conduct the first theoretical investigation on the impact of the LRDoS attack on a general feedback control system. We formally show that the attack can make the system's steady-state error oscillate along with the attack period, and prove the existence of LRDoS attacks that can force the system to be far off the desired state. In addition, we propose a novel methodology to systematically characterize the impact of an LRDoS attack on specific systems, and apply it to a web server and an IBM Notes server. This investigation obtains many new insights, such as new attack scenarios, the bound of the system's states, the relationship between the bound and the LRDoS attacks, the close-formed equations for quantifying the impact, and so on. The extensive experimental results are congruent with the theoretical analysis.

On a novel method of designing distributed LDoS attack based on network behavior features

This paper designs a distributed low-rate denial of service (LDoS) attack using one-dimensional random walk algorithm. One-dimensional random walk algorithm can be used in generating power-law distribution which complies with normal network behavior feature. In this attack pattern, the behavior of each distributed attack flows are normal and nonperiodic, while the aggregated effect has the same damage degree as traditional square wave LDoS attacks. As the distributed attack flow satisfies the network traffic behavior feature, it is even more difficult to detect and trace back attack sources. The study on the feature of this attack provides reference for distributed low-rate DoS attack countermeasures.

ASTVA: DDoS-Limiting Architecture for Next Generation Internet

Security is an important consideration in next generation Internet, where Distributed Denial of Service (DDoS) attack is still a serious threat, especially when Internet of Things is taken into account. To defend against DDoS, capability based Traffic Validation Architecture (TVA) is an excellent candidate. However, there are some shortcomings which make it not so practical, e.g., it has large capability overhead and some DoS attacks could escape from it. To overcome these problems, we proposed the autonomic system based architecture: ASTVA, which created and verified capability using autonomic system as the basic defense unit. In ASTVA, two kinds of sub-capabilities were provided and serveral system security levels were given by mixing the two kinds of sub-capabilities; several key parameters were adjusted dynamically to enhance system flexibility; and an anti-shrew function was added to TVA to make it more robust against low-rate DoS attacks. Finally, we gave out several simulation tests and the results show that ASTVA is more robust and flexible than TVA and is more practical to real world security.

Software based Low Rate DoS Attack Detection Mechanism

Existing DoS attack detection tools are unable to detect Low rate DoS (LDoS) attacks. Many researchers have proposed mechanisms to detect LdoS attack. But they require modifications to the existing infrastructure or protocols which is not practical. There should be a lightweight mechanism which could be integrated with existing Intrusion Detection Systems. This paper proposes a lightweight software-based approach for LdoS detection which could be integrated with existing Intrusion detection system and does not require any change in existing infrastructure and protocol.Experimental results are provided to support the effectiveness and efficiency of proposed mechanism.

Evaluation of a low-rate DoS attack against application servers

In the network security field there is a need to identify new movements and trends that attackers might adopt, in order to anticipate their attempts with defense and mitigation techniques. The present study explores new approaches that attackers could use in order to make denial of service attacks against application servers. We show that it is possible to launch such attacks by using low-rate traffic directed against servers, and apply the proposed techniques to defeat a persistent HTTP server. The low-rate feature is highly beneficial to the attacker for two main reasons: firstly, because the resources needed to carry out the attack are considerably reduced, easing its execution. Secondly, the attack is more easily hidden to security mechanisms that rely on the detection of high-rate traffic. In this paper, a mechanism that allows the attacker to control the attack load in order to bypass an IDS is contributed. We present the fundamentals of the attack, describing its strategy and design issues. The performance is also evaluated in both simulated and real environments. Finally, a study of possible improvement techniques to be used by the attackers is contributed.

On the impacts of low rate DoS attacks on VoIP traffic

AbstractLow rate TCP DoS (Shrew) and reduction of quality (RoQ) attacks have been proven to be detrimental to TCP traffic in the Internet. In this paper, we investigate the effect of these attacks on QoS sensitive, real time UDP traffic, like VoIP. Both of these attacks are difficult to detect, as the average attack traffic is low. These stealthy RoQ attacks are especially hard to detect as their periodicity is not well‐defined, and the attacks can contain spoofed source as well as destination IP addresses. Extensive ns2 simulations have been performed under realistic scenarios to validate the effects of these attacks on real time VoIP traffic using the G711 and G729a audio codecs. Forward Error Correction (FEC) is also considered in our analysis to recover packets from the packet loss caused by attacks. Without FEC, these attacks can drastically reduce the quality of VoIP traffic, leading to denial of service. To evaluate the perceptual quality of voice under attacks, the network losses are mapped to user's quality perception by using the ITU E‐model. The MOS range of the E‐model decreases from best to medium due to the low rate TCP DoS and RoQ attacks even when FEC is deployed. In some of the attack scenarios, the packet losses are bursty, which can lead to dropped calls. In addition, the stealthy RoQ attacks with higher burst lengths are as effective as the shrew attack in impairing VoIP traffic. We have also evaluated the effects of the attack on the VoIP traffic on the DETERLAB testbed, which has specifically been built for conducting network security research, and the results are consistent with the ns2 simulation results. We believe our investigation is important to remove the misconception about low rate TCP DoS and RoQ attacks that they affect only TCP traffic in the Internet. Copyright © 2008 John Wiley & Sons, Ltd.