A fast self-similarity matrix-based method for shrew DDoS attack detection
Debojit Boro, Mrinmoy Haloi, Dhruba K. Bhattacharyya · Information Security Journal A Global Perspective · 2020
Shrew DDoS attack mainly targets the TCP’s retransmission timeout (RTO) mechanism that handles severe cases of congestion and packet losses. This attack is very hard to detect due to its stealthy nature and low-rate in volume which if remained undetected can affect the legitimate TCP flows. In this paper, we propose a fast shrew DDoS attack detection method based on self-similarity matrix (SSM) that measures the self-similarity of network traffic across multiple time scales over a subset of relevant features. The method can detect any presence of shrew attack in-line with the incoming traffic samples and thus identify the attack flows. We experimented our method over real-life low-rate datasets for multiple scenarios and the results demonstrate its efficiency both in terms of detection accuracy and speed.