Low-Rate DDoS Attack Detection Using Expectation of Packet Size

Citations Over TimeTop 10% of 2017 papers

Abstract

Low-rate Distributed Denial-of-Service (low-rate DDoS) attacks are a new challenge to cyberspace, as the attackers send a large amount of attack packets similar to normal traffic, to throttle legitimate flows. In this paper, we propose a measurement—expectation of packet size—that is based on the distribution difference of the packet size to distinguish two typical low-rate DDoS attacks, the constant attack and the pulsing attack, from legitimate traffic. The experimental results, obtained using a series of real datasets with different times and different tolerance factors, are presented to demonstrate the effectiveness of the proposed measurement. In addition, extensive experiments are performed to show that the proposed measurement can detect the low-rate DDoS attacks not only in the short and long terms but also for low packet rates and high packet rates. Furthermore, the false-negative rates and the adjudication distance can be adjusted based on the detection sensitivity requirements.

Related Papers

• → Timing is Almost Everything: Realistic Evaluation of the Very Short Intermittent DDoS Attacks(2018)11 cited
• → DDoS attack detection method based on feature extraction of deep belief network(2019)9 cited
• Packet Simulation of Distributed Denial of Service (DDoS) Attack and Recovery(2013)
• DDOS’s attack and defense(2007)
• Study of DDoS Attack and Defense Models Based on MAS(2013)