Modeling and Simulation of Low Rate of Denial of Service Attacks

The low-rate denial of service attack is more applicable to the network in recent years as a means of attack, which is different from the traditional field type DoS attacks at the network end system or network using adaptive mechanisms exist loopholes flow through the low-rate periodic attacks on the implementation of high-efficiency attacked by an intruder and not be found, resulting in loss of user data or a computer deadlock. LDos attack since there has been extensive attention of researchers, the attack signature analysis and detection methods to prevent network security have become an important research topic. Some have been proposed for the current attacks were classified LDoS describe and model, and then in NS-2 platform for experimental verification, and then LDoS attack detection to prevent difficulties are discussed and summarized for the future such attacks detection method research work to provide a reference.

Low-Rate DoS Attack Flows Filtering Based on Frequency Spectral Analysis

In frequency domain,the power spectrum of Low-rate denial of service(LDoS) attacks is totally spread into the spectrum of normal traffic.It is a challenging task to detect and filter LDoS attack flows from the normal traffic.Based on the analysis of LDoS attack flows and legitimate TCP traffic in time and frequency domains,the periodicity of the TCP traffic and LDoS attack flows is explored to facilitate the research of network traffic processing.Hence,an approach of LDoS attack flow filtering based on frequency spectrum analysis is proposed.In this approach,the TCP traffic and LDoS attack flows are transformed from the time domain into the frequency domain.Then the round-trip time(RTT) is estimated by using frequency domain search method.Analysis of amplitude spectrum shows that TCP traffic energy is mainly concentrated on the points of n/RTT.Therefore,a comb filter using infinite impulse response(IIR) filter is designed to filter out the LDoS attack flows in frequency domain,while most legitimate TCP traffic energy at the points of n/RTT are pass through.Experimental results show that the maximum pass rate for legitimate TCP traffic reaches 92.55%,while the maximum filtration rate of LDoS attack flows reaches 81.36%.The proposed approach can effectively filter the LDoS attack flows while less impact on the legitimate TCP traffic.

The detection method of low-rate DoS attack based on multi-feature fusion

As a new type of Denial of Service(DoS)attacks,the Low-rate Denial of Service(LDoS)attacks make the traditional method of detecting Distributed Denial of Service Attack(DDoS)attacks useless due to the characteristics of a low average rate and concealment.With features extracted from the network traffic,a new detection approach based on multi-feature fusion is proposed to solve the problem in this paper.An attack feature set containing the Acknowledge character(ACK)sequence number,the packet size,and the queue length is used to classify normal and LDoS attack traffics.Each feature is digitalized and preprocessed to fit the input of the K-Nearest Neighbor(KNN)classifier separately,and to obtain the decision contour matrix.Then a posteriori probability in the matrix is fused,and the fusion decision index D is used as the basis of detecting the LDoS attacks.Experiments proved that the detection rate of the multi-feature fusion algorithm is higher than those of the single-based detection method and other algorithms.

针对TCP拥塞控制的LDOS检测与防范

传统的针对TCP拥塞控制的LDOS攻击检测与防范方法存在计算复杂、难以实现的不足。为此,基于分布式检测架构,提出一种快速简便的检测与防范方法。利用数字信号处理技术对攻击脉冲特征值进行提取及检测,柔化攻击风险。结果表明,该方法准确快速、能够实现实时报警,并可以避免复杂过滤算法给系统带来的计算负荷和正常数据的丢失。

SDN环境下的LDoS攻击检测与防御技术

低速率拒绝服务(LDoS)攻击是一种新型的网络攻击方式,其特点是攻击成本低,隐蔽性强。作为一种新型的网络架构,软件定义网络(SDN)同样面临着LDoS攻击的威胁。但SDN网络的控制与转发分离、网络行为可编程等特点又为LDoS攻击的检测和防御提供了新的思路。提出了一种基于OpenFlow协议的LDoS攻击检测和防御方法。通过对每条OpenFlow数据流的速率单独进行统计,并利用信号检测中的双滑动窗口法实现对攻击流量的检测,一旦检测到攻击流量,控制器便可以通过下发流表的方式实现对攻击行为的实时防御。实验表明,该方法能够有效检测出LDoS攻击,并能够在较短时间内实现对攻击行为的防御。

一种基于小波特征提取的低速率DoS检测方法

低速率拒绝服务攻击(low-ratedenial-of-service,简称LDoS)比传统的DDoS(distributed DoS)攻击更具隐蔽性和欺骗性,依据其周期性脉冲突发特点,设计实现了一种基于小波特征提取的LDoS检测系统DSBWA(detection system based on wavelet analysis).该系统以到达检测节点的数据包数目为研究对象,通过小波多尺度分析,结合LDoS的攻击规律提取5个特征指标,在此基础上采用BP神经网络进行综合诊断.一旦检测出LDoS攻击,系统定位攻击脉冲数据的到达时刻以获得攻击者的相关信息.NS-2模拟实验结果表明,DSBWA具有高检测率和低误警率,并且能够检测出LDoS变种攻击,消耗计算资源少,具有良好的实用价值.

软件定义网络环境下的低速率拒绝服务攻击检测方法

低速率拒绝服务(LDoS)攻击是一种拒绝服务(DoS)攻击改进形式,因其攻击平均速率低、隐蔽性强,使得检测LDoS攻击成为难点。针对上述难点,提出了一种在软件定义网络(SDN)的架构下,基于加权均值漂移-K均值算法(WMS-Kmeans)的LDoS攻击检测方法。首先,通过获取OpenFlow交换机的流表信息,分析并提取出SDN环境下LDoS攻击流量的六元组特征;然后,利用平均绝对值百分比误差作为均值漂移聚类中欧氏距离的权值,以此产生的簇心作为K-Means的初始中心对流表进行聚类,从而实现LDoS攻击的检测。实验结果表明:在SDN环境下,所提方法对LDoS攻击具有较好的检测性能,平均检测率达到99.29%,平均误警率和平均漏警率分别为1.97%和0.69%。

一种基于Haar小波变换的低速率拒绝服务攻击检测方法

依据LDoS攻击周期性脉冲突发的特点,提出一种基于Haar小波特征提取的低速率拒绝服务攻击检测方法.该方法采用信号处理技术来分析网络流量提取特征指标,通过小波多尺度分析对网络流量综合诊断,较好地缓解了合法用户背景流量对攻击特征提取的干扰.NS-2仿真实验结果表明,该方法检测率高,消耗计算资源少,具有良好的理论研究和实用价值.

LDDoS attack detection method based on wavelet decomposition and sliding windows

As a special type of distributed denial of service(DDoS) attacks, the low-rate DDoS(LDDoS) attacks have characteristics of low average rate and strong concealment, thus, it is hard to detect such attacks by traditional approaches. Through signal analysis, a new identification approach based on wavelet decomposition and sliding detecting window is proposed. Wavelet decomposition extracted from the traffic are used for multifractal analysis of traffic over different time scale. The sliding window from flow control technology is designed to identify the normal and abnormal traffic in real-time. Experiment results show that the proposed approach has advantages on detection accuracy and timeliness.