Filtering of shrew DDoS attacks in frequency domain

Abstract

The shrew Distributed Denial of Service (DDoS) attacks are periodic, bursty, and stealthy in nature. They are also known as Reduction of Quality (RoQ) attacks. Such attacks could be even more detrimental than the widely known flooding DDoS attacks because they damage the victim servers for a long time without being noticed, thereby denying new visitors to the victim servers, which are mostly e-commerce sites. Thus, in order to minimize the huge monetary losses, there is a pressing need to effectively detect such attacks in real-time.Unfortunately, effective detection of shrew attacks remains an open problem. In this paper, we meet this challenge by proposing a new signal processing approach to identifying and detecting the attacks by examining the frequency-domain characteristics of incoming traffic flows to a server. A major strength of our proposed technique is that its detection time is less than a few seconds. Furthermore, the technique entails simple software or hardware implementations, making it easily deployable in a real-life network environment.Index Terms-Network security, distributed denial of service (DDoS), reduction of quality (RoQ), digital signal processing (DSP), Internet traffic analysis

Study of Self-Similarity for Detection of Rate-based Network Anomalies

“…Yu Chen et al [95][96] on the other hand have done elaborate study of Low-rate DDoS attacks or Shrew attacks. In this paper a novel approach has been proposed that filters shrew attacks by analyzing the amplitude spectrum distribution in the frequency domain.…”

Flooding Distributed Denial of Service Attacks-A Review

“…Among the works proposed to mitigate the Shrew attacks are using Active Queue Management (AQM) (Aleksandra and Knightly, 2003), taking drop history of each flow into account (Mahajan et al, 2001), randomizing the fixed minimum RTO in TCP parameter in to make the synchronized attack more difficult, router-based detection using auto-correlation, fair resource allocation, detection at edge routers, halting anomaly with weighted choking, frequency domain spectrum analysis, wavelet-based approach, Shrew attack protection techniques based on signal analysis (Yu, Kai and Yu-Kwong, 2005), (Xiapu and Chang, 2005) and simple priority-tagging filtering mechanism (Chang et al, 2009). …”

Spectral Analysis of TCP Flows for Defense Against Reduction-of-Quality Attacks

“…The Internet research community has recognized the efficacy of using digital signal processing (DSP) techniques to detect DDoS attacks [5], [6], [7], [12], and [17]. These technologies sample the number of packet arrivals periodically and treated it as a time domain signal series.…”

“…We suggested to filter shrew attack flows by focusing on the extraordinary high energy allocated at the low frequency band [5]. Sun et al [24] also proposed to extract the signature of low-rate attack streams through analyzing the PSD of the autocorrelation sequence.…”

“…Recently, a variant of DDoS attacks has been identified that is even more difficult to detect. They are called shrew attacks [5], [21] or Reduction-of-Quality (RoQ) attacks [13]. These attacks do not denial the clients from services completely [9].…”