The Detection of LDoS Attack Based on the Model of Small Signal
Pei Bao-song · Dianzi xuebao · 2011
Low-rate denial of service(LDoS)is a new class of DoS attack,which exploits the deficiencies of the minimum RTO of TCP to send out attack packets about 10%-20% of normal traffic in short periodic pulses to a victim.It is hard to be detected through traditional detection mechanism.In this paper,an approach of detecting LDoS attack based on the model of small signal is proposed.The proposed approach takes statistics on the packets arriving in 30 seconds(sampling time is 10ms,total of 3000 sampling points),and compares the statistical result with the characteristic judging value,which is settled as a threshold to indicate the difference between normal and attack flow.An eigenvalue-estimating matrix is established to estimate the attack period after LDoS attack being detected.Simulation results in NS-2 environment show that the proposed approach can detect the LDoS attack effectively.