Detection and Mitigation of Low-Rate Denial-of-Service Attacks: A Survey

Abstract

The potential for being the target of Denial of Service (DoS) attacks is one of the most severe security threats on the Internet. Attackers have been modifying their attack format over the years, damaging specific conditions of operating systems and protocols in an attempt to deny or diminish the quality of the service provided to legitimate users. Nowadays, attacks are stealthier and mimic legitimate user traffic in such a way that detection mechanisms against High-rate DoS attacks are no longer sufficient. This evolving type of attack, known as LDoS (Low-rate Denial of Service) attacks, has the potential to produce more damage than its predecessor due to its stealth nature and the lack of suitable detection and defense methods. This survey summarizes and complements previous studies and surveys related to this specific type of attack. First, we propose a taxonomy of the LDoS attacks, which were divided into three broad categories based on their modus operandi: QoS attacks, Slow rate attacks, and Service queue attacks. Next, we detail numerous detection mechanisms and counter-measures available against eight types of LDoS attacks. More specifically, we describe the methods used to throttle the attack traffic. Finally, we provide a feature comparison table for some existing attack tools. This survey aims at providing an extensive review of the literature for helping researchers and network administrators find up-to-date knowledge on LDoS attacks.

High-Speed Network DDoS Attack Detection: A Survey

“…A high-speed network enables fast and effective communication between computers [16] [17] [18] 4 of 25 ernet, 100 Gigabit Ethernet, and InfiniBand [22]. A Cisco Report prernet protocol may cross 4.3 zettabytes in 2023, which is 1879 exabytes ].…”

“…In recent years, there have been several reviews in the literature of DoS attacks. For example, the authors of [ 16 ] presented the taxonomy of low-rate DoS attacks based on a three-layer modus operandi. The review included slow rate, service queue, and Quality of Service (QOS) attacks and described the various detection approaches against eight low-rate DoS attacks.…”

Light-Weight Slow-Rate Attack Detection Framework for Resource-Constrained Industrial Cyber-Physical Systems

“…Reviews of LDoS attacks exist [43,1,44,3,45], but none relates to resource-constrained ICPS. Similarly, some surveys review security concerns of the cyber-physical systems using ML/DL [46][47][48][49][50][51]; however, they do not cover LDoS or their detection.…”

“…(3) LDoS attack utilises TCP/IP protocol's three-way handshake mechanism where control measures look normal; however, this can reduce the quality of service [1,2]. LDoS attack is categorized into Quality of Services (QoS), SRA, and Service-Queue attacks based on the damage to the protocols [3]. SRA slow down application layer protocols by exploiting the methods and characteristics of these protocols' architecture and/or by causing buffer overflow (sharp increase in request-servicing time) [4].…”

“…In binary detection, optimised OSELM is trained to categorise the traffic into normal or attack traffic. In multi-class detection, optimised OSELM is trained to classify traffic into normal or different slow-rate attack types: Slowloris, Golden Eye, SlowHTTPTest, and Hulk [3]. The framework also includes the prediction component where the optimised OSELM is used in the evaluation/prediction of the new and unseen incoming traffic.…”