Low-Rate DoS Attacks, Detection, Defense, and Challenges: A Survey

Low‐rate denial of service (LDoS) attack is a special DoS attack type of wireless sensor network (WSN). Routing protocol is the critical component of the WSN. Routing flood attack is a novel LDoS attack pattern in WSN. However, the attack is difficult to be detected by traditional intrusion detection algorithm. A novel LDoS attack detection method based on big data and signal analysis is proposed. Hilbert–Huang Transform (HHT) time–frequency signal analysis method is used to analyse the small non‐linear signal from LDoS attack traffic signal. Spark‐based Pearson and Spearman correlation coefficient calculation approaches are used to recognise the false intrinsic mode functions (IMFs) components decomposed by the HHT method. The effective threshold value of Pearson correlation coefficient is set to 0.2, the effective threshold value of Spearman correlation coefficient is set to 0.3, which are united to identify the false IMF components. SunSpot wireless nodes are used to build the wireless sensor nodes. If the difference between the IMF component and the normal IMF component is more than 40%, the LDoS attack will be detected. Experimental results show that this approach is effective to detect the LDoS attack in ZigBee WSN. This is a quantitative LDoS attack detection experimental research in WSN.

The low-rate denial of service (LDoS) attack is known as a low-rate TCP attack with essentially a periodic short burst, which exploits the homogeneity of the minimum retransmission timeout (RTO) of TCP flows and forces all affected TCP flows to back off and enter the retransmission timeout state. LDoS attack is new threat to Internet and ISP service. This paper adopts the deficit round robin (DRR) algorithm to defend against LDoS attack. DRR algorithm provides bandwidth allocation and protection between flows to improve the throughput of all the TCP flow. Experiments on single low-rate attack on single TCP flow and multiple TCP flows show that DRR has an expected effect on resisting LDoS attack.

ADMS: An online attack detection and mitigation system for LDoS attacks via SDN

Low-rate Denial of Service (LDoS) attacks and TCP flows are be modeled in the time and frequency domain for the purpose of analyzing the signatures and extracting LDoS attack's period T and length L. A simulated LDoS attack signal is constructed based on the extracted parameters of T and L. The correlation between the signal of simulated LDoS attack and the hybrid signal (TCP flow plus LDoS attack) is calculated. To compare the correlation value with a detect threshold, which is determined through experiments. If the correlation value is exceeds the threshold, the LDoS attack is determined. The proposed method has been tested totally 1500 times in NS-2 environment and 200 times in real network environment with different parameters of T and L. Experimental results show that the false negative alarm rate P FN is less than 1.1%, the false positive alarm rate P FP are less than 0.8%, and the detect rate P D is more than 98%.

Low-rate Denial of Service (LDoS) attack exploiting vulnerabilities of TCP protocol for periodic attacks usually results in the degradation of service quality. Its short attack duration and low average attack traffic make it highly efficient and concealed. Existing detection methods against this type of attack still have a shortcoming that the accuracy is not so satisfactory. A method for detecting LDoS attacks using PSO and k-means algorithm is proposed in this paper. The method first divides the detection time into multiple detection units, samples the traffic data of the data stream and summarizes the traffic characteristics in each detection unit, and then it uses the K-means algorithm to calculate the clustering center. In order to conduct a better detection, the particle swarm optimization algorithm is used to perturb the clustering center to avoid the defect that the K-means algorithm is easy to fall into the local optimal solution. Finally, the network features after clustering are compared with the anomalous features generated after the LDoS attacks, and the relevant criteria is adopted to judge and subsequently verify the LDoS attacks. The experiments are carried out on multiple platforms and public datasets such as NS2 platform, test-bed platform, DARPA dataset, LBNL dataset and WIDE2018 dataset. The results of comparative experiments show that the proposed method has a better performance in effectively detecting LDoS attacks.

Low‐rate denial of service (LDoS) attacks exploit the congestion control mechanism to degrade the network quality of service. As a classic active queue management algorithm, random early detection (RED) algorithm is widely used to avoid network congestion. However, RED is vulnerable to LDoS attacks. LDoS attacks with well‐configured attack parameters force RED queue to fluctuate severely, thereby throttling transmission control protocol (TCP) senders’ sending rate. A feedback control model is proposed to describe the process of the congestion control, by which the congestion window and queue behaviours are analysed combined. After that, a two‐dimensional queue distribution model composed of the instantaneous queue and the average queue is designed to extract the attack feature. Moreover then, a combination of a simple distance‐based approach and an adaptive threshold algorithm is proposed to detect every LDoS attack burst. Test results of network simulator (NS)‐2 simulation and test‐bed experiments indicate that the proposed detection strategy can almost completely detect LDoS attack bursts and is especially robust to legitimate short bursts.

Three-Level detection algorithm is provided to detect low-rate denial of service attacks. The networks abnormities are caught in the first level; In the second level the flooding and low-rate denial of service(DoS) are divided; And then the Low-Rate DoS is detected accurately using frequency transfer method in the third level. Considering the application of networks, Low-Rate DoS attacks are detected and confirmed in Three-Level detection algorithm. Comparing with single level detection method, the most complex procedure is left behind to reduce detecting overhead. The simulation results certificate the feasibility of the algorithm.

A TCP-targeted Low-rate denial of service (LDoS) attack exploits the vulnerabilities of TCP congestion control mechanism. CUBIC is the most widely used TCP congestion control algorithm today. CUBIC TCP increases the resilience against LDoS over traditional TCP. This paper explores high-potency patterns of the LDoS attack against CUBIC TCP under RED queue management scenario, and accordingly develops two attack models referring to maximizing attack potency. Theoretical analyses and extensive experiments are conducted to validate the proper function of the two models and evaluate their performance. Test results show that the two attack models can effectively throttle CUBIC TCP throughput. Under standard-configured network parameters, the number of TCP units damaged by one attack unit are up to about 21 and 26 respectively for our proposed two models, which represents an increase in attack potency of about 20%. And, our proposed models outperform the traditional attack model in terms of attack potency by at least 250%. In addition, with variations in different network parameters, these two models are still efficient and alternatively maximize the attack potency. Finally, an outline for the attack countermeasure is discussed. The present study offers a basis to explore new attack manners which may be exploited by attackers and excites defenders to develop new measurements against such attack.

LDoS (low-rate denial-of-service) was a new type of DoS attack. In this paper, LDoS attack traffic was simulated on OPNET platform and generated by estimating the retransmission time out (RTO) of normal TCP flow based on the analysis of LDoS attack features, and the performance of targets under the attacking of LDoS was tested. We investigated the cache queue of target router for the purpose of detection and defense of LDoS attack. Test result show that two criterions -- packet percentage and threshold--can detect LDoS attack flows.

In this paper, a real cloud computing platform-oriented Low-rate Denial of Service (LDoS) attack detection method based on time-frequency characteristics of traffic data is proposed. All the traffic data flowing through the Web server is acquired by the collection and storage system, the original traffic data is divided into multiple flow segments by the preprocessing module, and the simple statistical features of several data packets in the flow are extracted by the analysis tool to form the detection sequence. The deep neural network is used to learn the potential time-frequency domain connection in the normal feature sequence and generate the reconstructed sequence. The discrimination module discriminates against the LDoS attack according to the difference between the reconstructed sequence and the input data in the time-frequency domain. The experimental results show that the proposed method can accurately detect the attack features in the stream segments in a very short time, and can achieve high detection accuracy for complex and diverse LDoS attacks. Because only the statistical characteristics of data packets are used, it is not necessary to analyze the data in the packets, which can be adapted to different network environments.

ZMW is a BGP-session-targeted LDoS (Low-Rate Denial of Service) attack, which can leave a drastic impact on the network infrastructure. Therefore, it’s essential to identify and know the attack. In this paper, we first establish a small-scale and double-link experimental network of BGP on the network simulator GNS3 to study this attack and generate LDoS attack flows by getting the required parameters. Then, we redo ZMW attack on target links through single nodes. We measure the overall effect of ZMW attack by monitoring the data traffic of target links and redundant links, and identify the links with route flapping by gathering the characteristic parameter, BGP table version number, and finally measure the attack efficiency of ZMW with adjusting the lengthen of UDP packet. We study and grasp this attack technology against BGP session, so as to give proper prevention scheme in time, thus effectively ensure the security of network and communication.

We propose using multiple observed features of network traffic to identify new high-distributed low-rate quality of services (QoS) violation so that detection accuracy may be further improved. For the multiple observed features, we chooseF featurein TCP packet header as a microscopic feature and,P featureandD featureof network traffic as macroscopic features. Based on these features, we establishmultistream fused hidden Markov model(MF-HMM) to detect stealthy low-rate denial of service (LDoS) attacks hidden in legitimate network background traffic. In addition, the threshold value is dynamically adjusted by using Kaufman algorithm. Our experiments show that the additive effect of combining multiple features effectively reduces the false-positive rate. The average detection rate of MF-HMM results in a significant 23.39% and 44.64% improvement over typical power spectrum density (PSD) algorithm and nonparametric cumulative sum (CUSUM) algorithm.

Low-Rate DoS (LDoS) attacks degrade the quality of service with less traffic than ordinary DoS attacks. LDoS attacks can easily evade conventional counter-DoS detection mechanisms because their time-averaged flow is small. Thus, LDoS attack is getting a serious problem nowadays. With the recent spread of IoT devices, Zigbee, one of the IoT communication standards, attracts much attention. Zigbee is a low-power wireless communication protocol at the sacrifice of its transfer range and bandwidth. Since Zigbee consumes low power, it is widely adopted for inexpensive small sensors and IoT that run on batteries. The advantage of the low power consumption of Zigbee is due to its use of indirect transmission. However, we newly found that vulnerability to LDoS attacks existed in the indirect transmission. In this study, we first point out this vulnerability and describe new LDoS attack scenarios exploiting it. Next, we propose simple countermeasures against them which require low computational cost. Then, simulation experiments are conducted to evaluate the impact of the attacks and the effectiveness of the proposed countermeasures. The experimental results show that the new LDoS attacks can decrease the normal packet arrival rate to 0% by adjusting the timing of attacks. It is also revealed that our proposed countermeasures successfully prevent such cases and improve the minimum arrival rate to 80% at best.

Low rate DoS attacks are emerging threats to the TCP traffic, and the VoIP traffic in the Internet. They are hard to detect as they intelligently send attack traffic inside the network to evade current router based congestion control mechanisms. We propose a practical attack model in which botnets that can pose a serious threat to the Internet are considered. Under this model, an attacker can scatter bots across the Internet to launch the low rate DoS attack, thus essentially orchestrating the low rate DoS attack that uses random and continuous IP address spoofing, but with valid legitimate IP addresses. It is difficult to detect and mitigate such an attack. We propose a low rate DoS attack detection algorithm, which relies on the core characteristic of the low rate DoS attack in introducing high rate traffic for short periods, and then uses a proactive test based differentiation technique to filter the attack packets. The proactive test was originally proposed to defend DDoS attacks and low rate DoS attacks which tend to ignore the normal operation of network protocols, but it is tailored here to differentiate the legitimate traffic from the low rate DoS attack traffic instigated by botnets. It leverages on the conformity of legitimate flows, which obey the network protocols. It mainly differentiates legitimate connections by checking their responses to the proactive tests which include puzzles for distinguishing botnets from human users. We finally evaluate and demonstrate the performance of the proposed low rate DoS attack detection and mitigation algorithm on the real Internet traces.

Due to the complicated and distributed characters of DDoS attack, a novel detection DDoS method based on global network is presented in this paper. Our method detects DDoS by analyzing network-wide traffic, whereas the traditional methods detect it on single link or victim network, they can only detect the DDoS which show large scope. Our method was carried out as follows: First, we get network traffic matrix. Then we diagnose DDoS in time domain and frequency domain by K-L transformation and computing correlation coefficient. K-L divides time domain and frequency domain sequence into normal space and abnormal space and then we compute the abnormal space's correlation coefficient. Finally, we set threshold to detect DDoS attack. The simulation result shows that some DDoS could be detected in time domain but others could only be detected in frequency domain. This method is more accurate and faster than traditional ones. It is well suited for detecting earlier DDoS attack.