Sequence alignment detection of TCP-targeted synchronous low-rate DoS attacks

Wu, Zhijun; Pan, Qingbo; Liu, Liang

doi:10.1016/j.comnet.2019.01.031

Cited by 47 publications

(19 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…. , N − 1, the correlation coefficient between x(n) and y(n) is r xy , and the calculation relationship is shown in the following formula [27][28][29]:…”

Section: Detection Methods Summarymentioning

confidence: 99%

“…In the actual situation, there is a delay d among the LDoS attack traffic coming from various paths, so formula (1) is insufficient to describe the correlation between the two attack sequences. erefore, in order to take the delay factor into account, the correlation r(d) of the sequence is redefined, and the correlation between x(n) and y(n) is calculated by the following formula [27][28][29]:…”

Section: Detection Methods Summarymentioning

confidence: 99%

“…e cyclic convolution calculation between two sequences is shown in the following formula [27][28][29]:…”

Section: Detection Methods Summarymentioning

confidence: 99%

See 2 more Smart Citations

Coherent Detection of Synchronous Low-Rate DoS Attacks

Yin

2021

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

Low-rate denial-of-service (LDoS) attacks are characterized by low average rate and periodicity. Under certain conditions, the high concealment of LDoS attacks enables them to transfer the attack stream to the network without being detected at all before the end. In this article, plenty of LDoS attack traffic is spread to the victim end to detect LDoS attacks. Through experimental analysis, it is found that the attack pulses at the victim end have sequence correlation, so the coherence detection technology in spread spectrum communication is proposed to detect LDoS attacks. Therefore, this paper proposes an attack detection method based on coherent detection, which adopts bivariate cyclic convolution algorithm. Similar to the generation of receiving terminal phase dry detection code in spread spectrum communication, we construct a local detection sequence to complete the extraction of LDoS attack stream from the background traffic of the victim terminal, that is, the coherent detection of LDoS attacks. When predicting the features of an LDoS attack, how to construct the parameters of the detection sequence (such as period, pulse duration, amplitude, and so on) is very important. In this paper, we observe the correlation of LDoS attacks and use coherence detection to detect LDoS attacks. By comparing calculated cross-correlation values with designed double threshold rules, the existence of attacks can be determined. The simulation platform and experiments show that this method has high detection performance.

show abstract

“…. , N − 1, the correlation coefficient between x(n) and y(n) is r xy , and the calculation relationship is shown in the following formula [27][28][29]:…”

Section: Detection Methods Summarymentioning

confidence: 99%

Section: Detection Methods Summarymentioning

confidence: 99%

See 1 more Smart Citation

Coherent Detection of Synchronous Low-Rate DoS Attacks

Yin

2021

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

show abstract

“…The feature-based defense strategy implements detection by analyzing the principles and features of LDoS attacks. Wu et al [26] proposed a method based on the sequence matching, which uses the Smith-Waterman algorithm and double threshold rules to detect LDoS attacks. Yue et al [27] proposed a method to detect the LDoS attack traffic using the wavelet energy spectrum and the combined neural network.…”

Section: The Feature-based Defense Strategymentioning

confidence: 99%

Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis

Tang

Dai

2020

Hum. Cent. Comput. Inf. Sci.

View full text Add to dashboard Cite

Denial of service (DoS) attack [1, 2] is a common attack vector, which generally seeks to exhaust the limited network resources, resulting in the legitimate users' requests not being processed. DoS attacks are becoming more widespread, targeting IoT networks [3, 4], SDN networks [5, 6], cloud computing environments [7, 8] and cyber-physical systems [9]. Aiming to combat DoS attacks, many methods have been proposed, in which a common detection method is based on abnormal statistical characteristics. Another type of DoS attack is the low-rate denial of service (LDoS) attack [10-12] that is hard to be accurately detected due to its low-rate nature. Many LDoS attacks have emerged, such as Shrew attacks [13], LoRDAS attacks [14], slow DoS attacks(e.g. Slow Next, SlowComm) [15, 16], etc. These attacks have the same characteristics, that is, they do not need to maintain sustained high-speed attack traffic to cause damage. Among all these attacks, TCP-targeted LDoS attacks are one of the most common LDoS attacks. To reduce the TCP's throughput, the attacker sends packet bursts

show abstract

“…They may also be expressed in the frequency domain, such as periodicity, abnormal frequency distribution of the traffic, and so on. However, these existing LDoS detection algorithms are only based on the characteristics in the time domain [15][16][17][18] or the frequency domain [2,19,20]. Another limitation associated with the emerging literature is that not enough attention has been paid to the adaptive ability of detection schemes to scenes and the filtering of noise in the environment.…”

Section: Introductionmentioning

confidence: 99%

Low-Rate DoS Attacks Detection Based on MAF-ADM

Zhan¹,

Tang²,

Man³

et al. 2019

Sensors

View full text Add to dashboard Cite

Low-rate denial of service (LDoS) attacks reduce the quality of network service by sending periodical packet bursts to the bottleneck routers. It is difficult to detect by counter-DoS mechanisms due to its stealthy and low average attack traffic behavior. In this paper, we propose an anomaly detection method based on adaptive fusion of multiple features (MAF-ADM) for LDoS attacks. This study is based on the fact that the time-frequency joint distribution of the legitimate transmission control protocol (TCP) traffic would be changed under LDoS attacks. Several statistical metrics of the time-frequency joint distribution are chosen to generate isolation trees, which can simultaneously reflect the anomalies in time domain and frequency domain. Then we calculate anomaly score by fusing the results of all isolation trees according to their ability to isolate samples containing LDoS attacks. Finally, the anomaly score is smoothed by weighted moving average algorithm to avoid errors caused by noise in the network. Experimental results of Network Simulator 2 (NS2), testbed, and public datasets (WIDE2018 and LBNL) demonstrate that this method does detect LDoS attacks effectively with lower false negative rate.

show abstract

Sequence alignment detection of TCP-targeted synchronous low-rate DoS attacks

Cited by 47 publications

References 15 publications

Coherent Detection of Synchronous Low-Rate DoS Attacks

Coherent Detection of Synchronous Low-Rate DoS Attacks

Low-rate DoS attack detection based on two-step cluster analysis and UTR analysis

Low-Rate DoS Attacks Detection Based on MAF-ADM

Contact Info

Product

Resources

About