Low-Rate DoS Attack Detection Based on Two-Step Cluster Analysis

Tang, Dan; Dai, Rui; Zhan, Sijia; Man, Jianping

doi:10.1007/978-3-030-01950-1_6

Cited by 10 publications

(4 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Two-step cluster analysis [21] includes balanced iterative reducing and clustering using hierarchies (BIRCH) algorithm and agglomerative hierarchical clustering algorithm. The a TCP traffic under LDoS attacks.…”

Section: Two-step Cluster Analysismentioning

confidence: 99%

See 1 more Smart Citation

Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis

Tang

Dai

2020

Hum. Cent. Comput. Inf. Sci.

Self Cite

View full text Add to dashboard Cite

Denial of service (DoS) attack [1, 2] is a common attack vector, which generally seeks to exhaust the limited network resources, resulting in the legitimate users' requests not being processed. DoS attacks are becoming more widespread, targeting IoT networks [3, 4], SDN networks [5, 6], cloud computing environments [7, 8] and cyber-physical systems [9]. Aiming to combat DoS attacks, many methods have been proposed, in which a common detection method is based on abnormal statistical characteristics. Another type of DoS attack is the low-rate denial of service (LDoS) attack [10-12] that is hard to be accurately detected due to its low-rate nature. Many LDoS attacks have emerged, such as Shrew attacks [13], LoRDAS attacks [14], slow DoS attacks(e.g. Slow Next, SlowComm) [15, 16], etc. These attacks have the same characteristics, that is, they do not need to maintain sustained high-speed attack traffic to cause damage. Among all these attacks, TCP-targeted LDoS attacks are one of the most common LDoS attacks. To reduce the TCP's throughput, the attacker sends packet bursts

show abstract

Section: Two-step Cluster Analysismentioning

confidence: 99%

“…To detect the TCP-targeted LDoS attack, a method using two-step cluster analysis [21] and UTR analysis is proposed. The cluster analysis is used to divide the network traffic with similar characteristics into the same cluster since the network traffic subjected to LDoS attacks has similar characteristics.…”

mentioning

confidence: 99%

Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis

Tang

Dai

2020

Hum. Cent. Comput. Inf. Sci.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Therefore, the traditional DoS detection methods are difficult to work. [3][4][5] Software defined network (SDN) is a new network architecture. By decoupling the data plane and the control plane, SDN can program the network dynamically, which provides flexible network management.…”

Section: Introductionmentioning

confidence: 99%

A hybrid deep learning model based low‐rate DoS attack detection method for software defined network

Sun

Guan

Peng

et al. 2022

Trans Emerging Tel Tech

View full text Add to dashboard Cite

The low-rate DoS (LDoS) attack is a new kind of network attack which has the characteristics such as low speed and good concealment. The software defined network, as a new type of network architecture, also faces the threat from LDoS attacks. In this article, we propose a detection method of LDoS attacks based on a hybrid deep learning model CNN-GRU: the convolutional neural network (CNN) and the gated recurrent unit (GRU). First, we extract field values such as n_packets and n_bytes, from the flow rule, and construct the average numbers of packets and bytes as the input data of the hybrid model. Then, to enhance the detection performance of the hybrid model, we improve the sailfish algorithm to optimize the hyperparameters of CNN and GRU automatically in the training process. Finally, we adopt hyperparameter optimized CNN and GRU to extract deeper spatial and temporal features of input data, respectively, which achieves accurate detection of the LDoS attack. The experimental results demonstrate that the proposed hybrid deep learning model-based method outperforms other traditional machine learning algorithms in terms of detection efficiency and accuracy.

show abstract

“…Tang et al [30] applied the two steps cluster to analyze network traffic on a large time scale. According to the characteristics of TCP traffic was abnormal when the LDoS attack occured, the abnormal cluster was further detected by using the concept of data slice from a small time.…”

mentioning

confidence: 99%

Low-Rate DoS Attacks Detection Based on MAF-ADM

Zhan¹,

Tang²,

Man³

et al. 2019

Sensors

Self Cite

View full text Add to dashboard Cite

Low-rate denial of service (LDoS) attacks reduce the quality of network service by sending periodical packet bursts to the bottleneck routers. It is difficult to detect by counter-DoS mechanisms due to its stealthy and low average attack traffic behavior. In this paper, we propose an anomaly detection method based on adaptive fusion of multiple features (MAF-ADM) for LDoS attacks. This study is based on the fact that the time-frequency joint distribution of the legitimate transmission control protocol (TCP) traffic would be changed under LDoS attacks. Several statistical metrics of the time-frequency joint distribution are chosen to generate isolation trees, which can simultaneously reflect the anomalies in time domain and frequency domain. Then we calculate anomaly score by fusing the results of all isolation trees according to their ability to isolate samples containing LDoS attacks. Finally, the anomaly score is smoothed by weighted moving average algorithm to avoid errors caused by noise in the network. Experimental results of Network Simulator 2 (NS2), testbed, and public datasets (WIDE2018 and LBNL) demonstrate that this method does detect LDoS attacks effectively with lower false negative rate.

show abstract

Low-Rate DoS Attack Detection Based on Two-Step Cluster Analysis

Cited by 10 publications

References 14 publications

Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis

Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis

A hybrid deep learning model based low‐rate DoS attack detection method for software defined network

Low-Rate DoS Attacks Detection Based on MAF-ADM

Contact Info

Product

Resources

About