Low-rate denial of service (LDoS) attack is a special DoS attack type of wireless sensor network (WSN). Routing protocol is the critical component of the WSN. Routing flood attack is a novel LDoS attack pattern in WSN. However, the attack is difficult to be detected by traditional intrusion detection algorithm. A novel LDoS attack detection method based on big data and signal analysis is proposed. Hilbert-Huang Transform (HHT) time-frequency signal analysis method is used to analyse the small non-linear signal from LDoS attack traffic signal. Spark-based Pearson and Spearman correlation coefficient calculation approaches are used to recognise the false intrinsic mode functions (IMFs) components decomposed by the HHT method. The effective threshold value of Pearson correlation coefficient is set to 0.2, the effective threshold value of Spearman correlation coefficient is set to 0.3, which are united to identify the false IMF components. SunSpot wireless nodes are used to build the wireless sensor nodes. If the difference between the IMF component and the normal IMF component is more than 40%, the LDoS attack will be detected. Experimental results show that this approach is effective to detect the LDoS attack in ZigBee WSN. This is a quantitative LDoS attack detection experimental research in WSN.

中文翻译：

---

无线传感器网络中基于火花辅助相关分析的新型LDoS攻击检测

低速率拒绝服务（LDoS）攻击是无线传感器网络（WSN）的一种特殊的DoS攻击类型。路由协议是WSN的关键组成部分。路由泛洪攻击是WSN中一种新颖的LDoS攻击模式。但是，传统的入侵检测算法很难检测到攻击。提出了一种基于大数据和信号分析的新型LDoS攻击检测方法。采用希尔伯特-黄变换（Hilbert-Huang Transform，HHT）时频信号分析方法，对LDoS攻击流量信号中的小非线性信号进行分析。基于Spark的Pearson和Spearman相关系数计算方法用于识别由HHT方法分解的虚假固有模式函数（IMF）分量。皮尔逊相关系数的有效阈值设置为0.2，Spearman相关系数的有效阈值设置为0.3，这些阈值结合起来可以识别错误的IMF分量。SunSpot无线节点用于构建无线传感器节点。如果IMF组件和正常IMF组件之间的差异大于40％，则将检测到LDoS攻击。实验结果表明，该方法可有效检测ZigBee WSN中的LDoS攻击。这是WSN中定量的LDoS攻击检测实验研究。实验结果表明，该方法可有效检测ZigBee WSN中的LDoS攻击。这是WSN中定量的LDoS攻击检测实验研究。实验结果表明，该方法可有效检测ZigBee WSN中的LDoS攻击。这是WSN中定量的LDoS攻击检测实验研究。