Flow-oriented detection of low-rate denial of service attacks
Zhijun Wu*
,†
, Ran Hu and Meng Yue
Tianjin Key Laboratory for Advanced Signal Processing, Civil Aviation University of China, Tianjin 300300, China
SUMMARY
In this paper, an approach of detecting low-rate denial of service attack is proposed on the basis of principal
component analysis algorithm. The proposed approach analyzes low-rate denial of service attack flows and
handles complicated network flows by using principal component analysis algorithm to establish the
network traffic matrix model, which is established on the basis of a large number of data acquisitions. Sim-
ulation results show that the proposed approach can predigest the high dimension vector, which is composed
of networks flows, guarantee the detection precision, and reduce the computation consuming. Copyright ©
2014 John Wiley & Sons, Ltd.
Received 13 October 2013; Revised 15 March 2014; Accepted 2 April 2014
KEY WORDS:
low-rate denial of service; principal component analysis; flow; detection
1. INTRODUCTION
For a long time, denial of service (DoS) attack has been one of the most serious security threats to
Internet [1] and wireless network [2], and it causes economic losses and bad social impacts. At pres-
ent, a novel DoS attack was found. This new type of attack is called low-rate DoS (LDoS) [3]. The
vulnerability of congestion control mechanism in transmission control protocol (TCP) or router ac-
tive queue management mechanism is used by LDoS attack to generate fake network congestion
signals. By sending periodic short pulses, LDoS attacks make the throughput of the victim hosts
greatly reduced. Low-rate distributed DoS (LDDoS) attack is composed of several single source
LDoS attacks with strict time relationship , namely, the time synchronization [4]. The presentation
of a single source LDoS attack can be described as a certain periodic pulse sequence, which can
be expressed by a three parameter group (T, L, R). Here, T is the attack period, an interval between
two successive attack pulses. L represents the attack pulse width, describing the time length. The
attackers would keep sending attack packets during this time. R denotes the attack pulse amplitude,
which indicates the highest rate of attack flow. Actually, LDoS attack cuts the pulse rate R into
many smaller data flows, which are separately transmitted by using multiple puppet machines with
limited transmission time. Hidden in the normal fl ows, the smaller attack flows are converged into a
pulse rate of R at the end of victims to form attacks. In details, an LDDoS attack is composed of M
attack sources that generate the smaller attack square waves. The sources are required to keep
consistency with the attack pulse characteristics in period and pulse width. For each attack pulse,
the normalized attack rate should be r
i
¼ R
1
M
; i ¼ 1; 2; ⋯; M [5]. Hence, all the smaller attack
pulses are aggregated at the end of victims to produce a large enough attack pulses. This process
is called flow aggregation. In LDoS attacks, the ratio of pulse width L to period T is smaller, which
means that an LDoS attack is a smaller duty cycle square wave signal in time domain. The smaller
*Correspondence to: Zhijun Wu, Tianjin Key Laboratory for Advanced Signal Processing, Civil Aviation University of
China, Tianjin 300300, China.
†
E-mail: zjwu@cauc.edu.cn
Copyright © 2014 John Wiley & Sons, Ltd.
INTERNATIONAL JOURNAL OF COMMUNICATION SYSTEMS
Int. J. Commun. Syst. 2016; 29:130–141.
Published online 30 April 2014 in Wiley Online Library (wileyonlinelibrary.com). DOI: 10.1002/dac.2805
剩余11页未读，继续阅读
资源评论
