Detection of LDoS attacks using variant of CUSUM and Shiryaev — Roberts's algorithm
Gagandeep Kaur, Pritee Agrawal · 2016
Today's cyber world is highly dependent on the internet. And like any other information and communication system the users of the internet, although enjoy it's services, but also suffer the vulnerabilities. One of the most damaging and ever changing amongst these is degradation in internet quality-of-services due to DDoS attacks. These attacks are easy to launch because of the high availability of bots and certain weaknesses of the TCP-IP protocol stack. Consequently, it is critical to study DDoS attacks and develop techniques for fast, accurate and reliable detection of these attacks. In this paper we have considered a subset of these attacks, the Low rate Pulsating DoS (LDoS) attacks for our study. The aim is to detect and deter these stealthy attacks, dynamically, using Checkpoint Anomaly Detection techniques. A variant of the Shiryaev — Roberts's procedure has been shown to be optimal in this setting.