Detecting Low-Rate DoS Attacks Based on Signal Cross-Correlation
WU Zhi-ju · Dianzi xuebao · 2014
Low-rate Denial of Service( LDoS) attack is TCP-targeted attack,which attempts to deny bandwidth of TCP flows. LDoS attacks send intensive periodic pulses at sufficiently low average rate to elude detection of DoS defense system. Based on the sequence relation between the distributed LDoS attack pulses arriving at the destination,a cross-correlation LDoS attack detection method is proposed by using cyclic convolution. This method builds a detection sequence for the purpose of exploring the timing relationship for distributed LDoS attack pulses arriving at the specific destination. Through computing the relation between the constructed detection sequence and sampled network flow sequence,the cross sequence is obtained. The cyclic convolution cross-relation algorithm is utilized to compute the precise time that the attack pulses arriving at the specific destination through different transferring channels. With nonperiodic monopulse prediction technology,the periodic parameters of LDoS attack are estimated,the relation characteristic of the pulse durations of LDoS attacks is extracted,and the threshold rules are designed. Experimental results show that the proposed algorithm of LDoS attack detection based on signal correlation achieves good detection performance.