Abstract:Distributed denial of service (DDoS) attacks have been a typical and extremely destructive threat to the Internet. DDoS attack detections suffer from the nonnegligible high complexity of massive traffic flow storage in the high-speed network. Besides, hidden low-rate DDoS (LDDoS) attacks evade the existing detection methods due to the similarity between LDDoS attack traffic and normal traffic. Focusing on these problems, this paper proposes a new low-rate DDoS attack detection method (LDDM) by designing the multidimensional sketch structure and novel measurement methods on network flows. First, the multidimensional sketch structure is designed to aggregate and compress network flows, which contributes to reduce the cost of data storage and enhance detection performance. Then, the improved behavior divergence measurement method based on daub 4 wavelet transform is proposed to calculate the energy percentage of each sketch divergence. This method obtains effective results in distinguishing the normal traffic and attack traffic. Furthermore, a modified weighted exponential moving average method is designed to construct the dynamic threshold of normal network. Meanwhile, a traffic freezing mechanism is proposed to ensure the standardization of the dynamic threshold. Finally, the effectiveness of the LDDM is evaluated using several real low-rate DDoS attack datasets. The comparisons with other methods illustrate our method has a lower false positive rate and false negative rate, as well as higher accuracy in the detection of stealthy low-rate DDoS attacks.

Detecting the DDoS attacks based on SYN proxy and Hop-Count Filter

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Detecting SYN Flooding Agents under Any Type of IP Spoofing

Detection of low-rate DDoS attack based on self-similarity

Router based detection for low-rate agents of DDoS attack

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

A novel mechanism to defend against low-rate denial-of-service attacks

Detection and Defense of SYN Flood Attacks Based on Dual Stack Network Firewall

A Method Based on AMHI for DDoS Attacks Detection and Defense

A Lightweight Ddos Flooding Attack Detection Algorithm Based On Synchronous Long Flows

Light-weight Detection Method Against SYN Flooding Attacks

Analysis and realization of anti-DDoS attack algorithm based on the SYN Cookie mechanism

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

Real-time SYN Flooding Attacks Detection Method Based on Hurst Parameter

Detection and Mitigation of SYN Flooding Attacks through SYN/ACK Packets and Black/White Lists

An Approach of Defending Against DDoS Attack

A Robust Scheme To Detect Syn Flooding Attacks

A More Accurate Scheme to Detect SYN Flood Attacks

Low-rate DDoS attacks detection method using data compression and behavior divergence measurement