Novel LDoS attack detection by Spark‐assisted correlation analysis approach in wireless sensor network

Low-rate Denial of service (LDoS) attacks has become one of the biggest threats to the Internet, cloud computing platforms, and big data centers. As an evolutionary species of DDoS attack, LDoS attack is essentially different from the DDoS attack. DDoS attacks are the behavior of malicious blocking legitimate network traffic by destroying the targets and the infrastructure around it with huge network traffic. While, LDoS attacks are the behavior of intentional degrading the quality of TCP links by throttling TCP flows to a small fraction of its ideal rate with periodic small pulse sequence. Hence, LDoS attack has a very small flow (around 10%–20% of the background traffic), it is easy to eluding the detection of routers and counter-DoS mechanisms. We try to reveal the mechanism of the LDoS attack and attempt to figure out the generation principle of LDoS attack in this paper. We classify the LDoS attacks and existing defense methods according to time domain and frequency domain in which detection and defense are performed. Furthermore, we highlight the filter approach to defense against LDoS attack. The initial purpose of our work is to encourage researchers to study effective ways to detect and defend against LDoS attacks with innovation and aggressiveness.

The low-rate denial of service (LDoS) attack is known as a low-rate TCP attack with essentially a periodic short burst, which exploits the homogeneity of the minimum retransmission timeout (RTO) of TCP flows and forces all affected TCP flows to back off and enter the retransmission timeout state. LDoS attack is new threat to Internet and ISP service. This paper adopts the deficit round robin (DRR) algorithm to defend against LDoS attack. DRR algorithm provides bandwidth allocation and protection between flows to improve the throughput of all the TCP flow. Experiments on single low-rate attack on single TCP flow and multiple TCP flows show that DRR has an expected effect on resisting LDoS attack.

ADMS: An online attack detection and mitigation system for LDoS attacks via SDN

Low-rate Denial of Service (LDoS) attack exploiting vulnerabilities of TCP protocol for periodic attacks usually results in the degradation of service quality. Its short attack duration and low average attack traffic make it highly efficient and concealed. Existing detection methods against this type of attack still have a shortcoming that the accuracy is not so satisfactory. A method for detecting LDoS attacks using PSO and k-means algorithm is proposed in this paper. The method first divides the detection time into multiple detection units, samples the traffic data of the data stream and summarizes the traffic characteristics in each detection unit, and then it uses the K-means algorithm to calculate the clustering center. In order to conduct a better detection, the particle swarm optimization algorithm is used to perturb the clustering center to avoid the defect that the K-means algorithm is easy to fall into the local optimal solution. Finally, the network features after clustering are compared with the anomalous features generated after the LDoS attacks, and the relevant criteria is adopted to judge and subsequently verify the LDoS attacks. The experiments are carried out on multiple platforms and public datasets such as NS2 platform, test-bed platform, DARPA dataset, LBNL dataset and WIDE2018 dataset. The results of comparative experiments show that the proposed method has a better performance in effectively detecting LDoS attacks.

Low-rate Denial of Service (LDoS) attacks and TCP flows are be modeled in the time and frequency domain for the purpose of analyzing the signatures and extracting LDoS attack's period T and length L. A simulated LDoS attack signal is constructed based on the extracted parameters of T and L. The correlation between the signal of simulated LDoS attack and the hybrid signal (TCP flow plus LDoS attack) is calculated. To compare the correlation value with a detect threshold, which is determined through experiments. If the correlation value is exceeds the threshold, the LDoS attack is determined. The proposed method has been tested totally 1500 times in NS-2 environment and 200 times in real network environment with different parameters of T and L. Experimental results show that the false negative alarm rate P FN is less than 1.1%, the false positive alarm rate P FP are less than 0.8%, and the detect rate P D is more than 98%.

Low‐rate denial of service (LDoS) attacks exploit the congestion control mechanism to degrade the network quality of service. As a classic active queue management algorithm, random early detection (RED) algorithm is widely used to avoid network congestion. However, RED is vulnerable to LDoS attacks. LDoS attacks with well‐configured attack parameters force RED queue to fluctuate severely, thereby throttling transmission control protocol (TCP) senders’ sending rate. A feedback control model is proposed to describe the process of the congestion control, by which the congestion window and queue behaviours are analysed combined. After that, a two‐dimensional queue distribution model composed of the instantaneous queue and the average queue is designed to extract the attack feature. Moreover then, a combination of a simple distance‐based approach and an adaptive threshold algorithm is proposed to detect every LDoS attack burst. Test results of network simulator (NS)‐2 simulation and test‐bed experiments indicate that the proposed detection strategy can almost completely detect LDoS attack bursts and is especially robust to legitimate short bursts.

Three-Level detection algorithm is provided to detect low-rate denial of service attacks. The networks abnormities are caught in the first level; In the second level the flooding and low-rate denial of service(DoS) are divided; And then the Low-Rate DoS is detected accurately using frequency transfer method in the third level. Considering the application of networks, Low-Rate DoS attacks are detected and confirmed in Three-Level detection algorithm. Comparing with single level detection method, the most complex procedure is left behind to reduce detecting overhead. The simulation results certificate the feasibility of the algorithm.

LDoS (low-rate denial-of-service) was a new type of DoS attack. In this paper, LDoS attack traffic was simulated on OPNET platform and generated by estimating the retransmission time out (RTO) of normal TCP flow based on the analysis of LDoS attack features, and the performance of targets under the attacking of LDoS was tested. We investigated the cache queue of target router for the purpose of detection and defense of LDoS attack. Test result show that two criterions -- packet percentage and threshold--can detect LDoS attack flows.

A TCP-targeted Low-rate denial of service (LDoS) attack exploits the vulnerabilities of TCP congestion control mechanism. CUBIC is the most widely used TCP congestion control algorithm today. CUBIC TCP increases the resilience against LDoS over traditional TCP. This paper explores high-potency patterns of the LDoS attack against CUBIC TCP under RED queue management scenario, and accordingly develops two attack models referring to maximizing attack potency. Theoretical analyses and extensive experiments are conducted to validate the proper function of the two models and evaluate their performance. Test results show that the two attack models can effectively throttle CUBIC TCP throughput. Under standard-configured network parameters, the number of TCP units damaged by one attack unit are up to about 21 and 26 respectively for our proposed two models, which represents an increase in attack potency of about 20%. And, our proposed models outperform the traditional attack model in terms of attack potency by at least 250%. In addition, with variations in different network parameters, these two models are still efficient and alternatively maximize the attack potency. Finally, an outline for the attack countermeasure is discussed. The present study offers a basis to explore new attack manners which may be exploited by attackers and excites defenders to develop new measurements against such attack.

To investigate the nonstationary characteristics of strong typhoons, this paper considers the evolutionary spectral characteristics of strong typhoons based on the Hilbert-Huang transform (HHT). Discrete expressions are determined for the evolutionary spectral analysis based on the HHT. The study indicates that the classic empirical mode decomposition (EMD) method fails to extract all of the high-frequency fluctuations from wind velocity data, and the time-averaged power spectrum obtained directly using the HHT cannot provide the true wind velocity spectrum. The degrees of nonstationarity of different-order IMF components are analysed and a synthesized method of analysing the evolutionary spectrum and time-averaged power spectrum of a strong typhoon is proposed. To avoid the energy leakage problem that exists in HHT spectral analyses, the Gram-Schmidt method is used to orthogonalize the intrinsic mode function (IMF) components. The study indicates that when the orthogonalization is implemented in accordance with the sequence from high-order IMF components to low-order ones, the orthogonalized components retain the same good Hilbert property as that of the IMFs. The synthesized method proposed yields a time-averaged power spectrum that is consistent with the Fourier spectrum in value and can produce the energy distributions of a typhoon in the time and frequency domains simultaneously.

In distributed generation (DG) connected grid system, there is serious harmonic pollution caused by the wide use of inverter units and nonlinear loads. The traditional detection methods (such as Fast Fourier Transform and wavelet analysis) heavily depend on synchronous signal detection or basis functions selection, which don’t satisfy the requirements of the harmonic detection of the micro-grid environment. Therefore, a novel method combining discrete wavelet transform (DWT) with Hilbert–Huang transform (HHT) is proposed to detect and analyze the harmonic. The method uses multi resolution analysis of DWT to process the original signal. Then, a series of intrinsic mode function (IMF) components are obtained from the processed signal by using Empirical Mode Decomposition (EMD) algorithm. Thirdly, the fundamental component and harmonic are extracted from the IMF components. Finally, the frequency and amplitude of the signal are calculated by using the HHT. Simulation results demonstrate that the proposed algorithm has high precision and good real-time characteristics. Furthermore, the proposed algorithm satisfies the requirements of the harmonic detection of the DG connected grid system.

In order to extract the vibration feature of remanufactured engines, the vibration signal is decomposed by ensemble empirical mode decomposition(EEMD), and this method is applied to study vibration mode of remanufactured engines. Based on the decomposition of vibration signal, correlation coefficient is introduced to study the correlation between IMF(Intrinsic Mode Function) components and original signal, and sensitive factors of IMF components are calculated using correlation coefficients. Hilbert transform is made with sensitive IMF components. The study results show that vibration feature of remanufactured engines is include in IMF components decomposed by EEMD, the vibration modes of remanufactured engines can be differentiated by Hilbert-Huang spectrum and marginal spectrum based on sensitive IMF components. According to vibration feature, the vibration state of remanufactured engines is divided into cylinder wall, cylinder cover and crankshaft vibration modes, which are important to improve the remanufacture level of engines.

In this paper, a real cloud computing platform-oriented Low-rate Denial of Service (LDoS) attack detection method based on time-frequency characteristics of traffic data is proposed. All the traffic data flowing through the Web server is acquired by the collection and storage system, the original traffic data is divided into multiple flow segments by the preprocessing module, and the simple statistical features of several data packets in the flow are extracted by the analysis tool to form the detection sequence. The deep neural network is used to learn the potential time-frequency domain connection in the normal feature sequence and generate the reconstructed sequence. The discrimination module discriminates against the LDoS attack according to the difference between the reconstructed sequence and the input data in the time-frequency domain. The experimental results show that the proposed method can accurately detect the attack features in the stream segments in a very short time, and can achieve high detection accuracy for complex and diverse LDoS attacks. Because only the statistical characteristics of data packets are used, it is not necessary to analyze the data in the packets, which can be adapted to different network environments.

ZMW is a BGP-session-targeted LDoS (Low-Rate Denial of Service) attack, which can leave a drastic impact on the network infrastructure. Therefore, it’s essential to identify and know the attack. In this paper, we first establish a small-scale and double-link experimental network of BGP on the network simulator GNS3 to study this attack and generate LDoS attack flows by getting the required parameters. Then, we redo ZMW attack on target links through single nodes. We measure the overall effect of ZMW attack by monitoring the data traffic of target links and redundant links, and identify the links with route flapping by gathering the characteristic parameter, BGP table version number, and finally measure the attack efficiency of ZMW with adjusting the lengthen of UDP packet. We study and grasp this attack technology against BGP session, so as to give proper prevention scheme in time, thus effectively ensure the security of network and communication.

We propose using multiple observed features of network traffic to identify new high-distributed low-rate quality of services (QoS) violation so that detection accuracy may be further improved. For the multiple observed features, we chooseF featurein TCP packet header as a microscopic feature and,P featureandD featureof network traffic as macroscopic features. Based on these features, we establishmultistream fused hidden Markov model(MF-HMM) to detect stealthy low-rate denial of service (LDoS) attacks hidden in legitimate network background traffic. In addition, the threshold value is dynamically adjusted by using Kaufman algorithm. Our experiments show that the additive effect of combining multiple features effectively reduces the false-positive rate. The average detection rate of MF-HMM results in a significant 23.39% and 44.64% improvement over typical power spectrum density (PSD) algorithm and nonparametric cumulative sum (CUSUM) algorithm.