Abstract:Distributed denial of service (DDoS) attacks have been a typical and extremely destructive threat to the Internet. DDoS attack detections suffer from the nonnegligible high complexity of massive traffic flow storage in the high-speed network. Besides, hidden low-rate DDoS (LDDoS) attacks evade the existing detection methods due to the similarity between LDDoS attack traffic and normal traffic. Focusing on these problems, this paper proposes a new low-rate DDoS attack detection method (LDDM) by designing the multidimensional sketch structure and novel measurement methods on network flows. First, the multidimensional sketch structure is designed to aggregate and compress network flows, which contributes to reduce the cost of data storage and enhance detection performance. Then, the improved behavior divergence measurement method based on daub 4 wavelet transform is proposed to calculate the energy percentage of each sketch divergence. This method obtains effective results in distinguishing the normal traffic and attack traffic. Furthermore, a modified weighted exponential moving average method is designed to construct the dynamic threshold of normal network. Meanwhile, a traffic freezing mechanism is proposed to ensure the standardization of the dynamic threshold. Finally, the effectiveness of the LDDM is evaluated using several real low-rate DDoS attack datasets. The comparisons with other methods illustrate our method has a lower false positive rate and false negative rate, as well as higher accuracy in the detection of stealthy low-rate DDoS attacks.

Global Detection of DDoS Attack Based on Time and Frequency Analysis

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

DDoS Attack Detection Based on Global Network Properties of Network Traffic Anomaly

Detection of low-rate DDoS attack based on self-similarity

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

Global Abnormal Correlation Analysis for DDoS Attack Detection

LDoS attack detection method based on traffic time-frequency characteristics

Automatic Detection of Distributed Denial of Service Attacks Based on Time-Frequency Analysis

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

Detecting DDoS Attacks Based on Network Connection Statistics

Spatio-Temporal Graph Convolutional Networks for DDoS Attack Detecting.

A Method of Run-Time Detecting Ddos Attacks

Detection of Application-Layer DDoS Attack Based on Time Series Analysis

Detecting DDoS Attacks Against Web Server Using Time Series Analysis

Detecting DDoS Attacks Against Data Center with Correlation Analysis.

A LDoS Detection Method Based on Packet Arrival Time

A novel DDoS attack detection method

Low-rate DDoS attacks detection method using data compression and behavior divergence measurement

Detecting DDoS Attack Based on Compensation Non-Parameter CUSUM Algorithm

DDoS flood attack detection based on fractal parameters