Shrew Attack Prevention in RED Queue with Partial Flow Analysis

Abstract

Shrew Attacks or Low Rate Denial of Service(LDoS) Attacks are initiated by sending large amount of packets for very short span of time such that the packet sending rate crosses the link capacity resulting in network congestion. Compared to Denial of Service (DoS) Attack, LDoS attack is very difficult to be detected because, the attacker can maintain low average packet sending rate while executing an attack. If the rate and interval of LDoS attack is properly estimated and executed, this attack can cause a severe threat to the retransmission time out adjustment of TCP and hence reduce its throughput to near zero. This paper proposes a lightweight LDoS filter which can be added with Preferential Dropping RED, to detect and prevent LDoS packets before they reach RED dropping policy. The advantage of this method is that only partial flows need to be analyzed to detect an attack. Simulations done in NS2 shows that, our method can effectively mitigate LDoS attack while maintaining fairness in bandwidth and low average queuing delay.

A new metric for flow‐level filtering of low‐rate DDoS attacks

“…RED‐FT's LDDoS detection mechanism is nearly identical to RRED. Another RED‐like approach is proposed in . This approach uses the same filtering method as RRED; however, it uses RED preferential dropping as an AQM model.…”