A new detection method for LDoS attacks based on data mining

Abstract

The serving capabilities of networks are reduced by low-rate denial of service (LDoS) attacks that periodically send high-intensity pulse data flows. This type of attack shows a harmful effect similar to that of traditional DoS attacks, but their attack modes differ greatly. The high concealment of LDoS attacks makes it extremely difficult for traditional DoS detection methods to detect LDoS attacks. Meanwhile, the state-of-art detection methods for LDoS attacks have low-efficiency and resource-intensive and time complexity issues. We propose a novel detection method with analysis of abnormal network traffic under LDoS attacks that combines data mining technology. The judgement benchmarks were also established. The results from the experimental simulation on the simulated environment, physical environment and public datasets prove that the developed method can effectively detect LDoS attacks with optimal detection cost and low complexity, and has a high accuracy, a low false-negative rate, and a low false-positive rate.

Introduction

Denial of Service (DoS) attacks, an essential problem bothering the field of network security, still pose a great threat today. Low-rate denial of service (LDoS) [1] attacks are a type of DoS attack. This sort of attack first appeared on the Internet2 backbone in 2001 [2].

Different from other flooding-style DoS attacks, LDoS attacks take advantage of security vulnerabilities in network adaptive mechanisms to send high-speed periodic bursts to reduce the utilization of the target network. For example, in traditional networks, LDoS attacks against the transport layer usually exploit the TCP/IP congestion control mechanism to maintain the target network in constant switching confusion between congestion and recovery for a long time, significantly reducing network availability and quality of service. Due to the short duration of each pulse and the long silence time of each cycle, the mean rate of the attack flow is quite low. By virtue of the low mean rate nature of LDoS attacks, malicious users can effortlessly hide each attack pulse within legitimate traffic. This makes it easy for attack traffic to be overlooked and mistaken for normal traffic. Many of today’s network platforms are still threatened by LDoS attacks, such as software defined networking [3], and cloud computing platforms [4], [5].

LDoS attacks exhibit a high degree of stealth and traditional DoS detection mechanisms have difficulty identifying them, so it is necessary to perform a separate study on them. In this paper, we study LDoS attacks at the transport layer. The threat model will be introduced in Section 3. Most of the existing detection schemes for LDoS attacks at the transport layer are highly complex and inefficient in detection, but do not have high accuracy. Therefore, we attempt to develop a low-complexity, efficient, and high-accuracy detection scheme starting from the distribution of traffic using data mining techniques.

In this paper, we propose a novel LDoS attack detection method that can identify LDoS attacks at the transport layer with high efficiency and low detection cost. To develop this method, this paper first describes two kinds of abnormal phenomena, TCP data flow distribution and fluctuation, under the influence of LDoS attacks. In this part, we combine data mining techniques to analyse network traffic anomalies caused by LDoS attacks, including the use of frequency histograms and Gaussian distributions to analyse the anomalous frequency distribution of network traffic. Second, this paper summarizes three abnormal features of the frequency distribution, distribution pattern and fluctuation pattern of the network under LDoS attacks. Finally, this paper uses three analysis methods to analyse and measure the abnormal characteristics and establishes three relevant judgement benchmarks. We evaluated the efficiency of the method by conducting experiments in different environments. In our experiments, we also verify the effectiveness of the features derived from the analysis of data mining techniques in this paper. The results demonstrate that this adaptive method can be applied in detecting LDoS attacks with its effectiveness and accuracy. The importance and originality of this study are that it explores the following four aspects.

• The anomalies of the network under LDoS attacks are analysed utilizing data mining techniques.

• Three anomalous features of the network under LDoS attacks and judgement benchmarks for detection are proposed.

• The method in this paper is validated in five different environments, including the simulation platform, the physical environment, local area networks, wide area networks, and data centre networks.

• The detection method in this paper is capable of detecting LDoS attacks with low cost, low complexity and high accuracy.

The rest of this paper proceeds as follows. Section 2 reviews several schemes for LDoS attack detection in traditional networks. Section 3 describes the principles and threat models of transport layer LDoS attacks. Section 4 analyses and presents three detection benchmarks in detail and describes the approach of this paper. Section 5 presents the experiments and analyses the results under five settings. Section 6 summarizes our work and discusses directions for improvement related to the approach of this paper.