Please use this identifier to cite or link to this item: http://hdl.handle.net/10397/8943
Title: Flow level detection and filtering of low-rate DDoS
Authors: Zhang, C
Cai, Z
Chen, W
Luo, X 
Yin, J
Keywords: Congestion
DDoS
Detection
Low-rate DoS
Issue Date: 2012
Publisher: Elsevier
Source: Computer networks, 2012, v. 56, no. 15, p. 3417-3431 How to cite?
Journal: Computer networks 
Abstract: The recently proposed TCP-targeted Low-rate Distributed Denial-of-Service (LDDoS) attacks send fewer packets to attack legitimate flows by exploiting the vulnerability in TCP's congestion control mechanism. They are difficult to detect while causing severe damage to TCP-based applications. Existing approaches can only detect the presence of an LDDoS attack, but fail to identify LDDoS flows. In this paper, we propose a novel metric - Congestion Participation Rate (CPR) - and a CPR-based approach to detect and filter LDDoS attacks by their intention to congest the network. The major innovation of the CPR-base approach is its ability to identify LDDoS flows. A flow with a CPR higher than a predefined threshold is classified as an LDDoS flow, and consequently all of its packets will be dropped. We analyze the effectiveness of CPR theoretically by quantifying the average CPR difference between normal TCP flows and LDDoS flows and showing that CPR can differentiate them. We conduct ns-2 simulations, test-bed experiments, and Internet traffic trace analysis to validate our analytical results and evaluate the performance of the proposed approach. Experimental results demonstrate that the proposed CPR-based approach is substantially more effective compared to an existing Discrete Fourier Transform (DFT)-based approach - one of the most efficient approaches in detecting LDDoS attacks. We also provide experimental guidance to choose the CPR threshold in practice.
URI: http://hdl.handle.net/10397/8943
ISSN: 1389-1286
DOI: 10.1016/j.comnet.2012.07.003
Appears in Collections:Journal/Magazine Article

Access
View full-text via PolyU eLinks SFX Query
Show full item record

SCOPUSTM   
Citations

27
Last Week
0
Last month
0
Citations as of Aug 18, 2017

WEB OF SCIENCETM
Citations

20
Last Week
0
Last month
2
Citations as of Aug 16, 2017

Page view(s)

42
Last Week
2
Last month
Checked on Aug 13, 2017

Google ScholarTM

Check

Altmetric



Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.