Low-rate denial of service (LDoS) attack detection method based on small signal detection theory

Abstract

A low-rate denial of service (LDoS) attack flow has an obvious periodical small-signal characteristic. By means of a small-signal detection theory, the invention provides an LDoS attack detection method based on a small-signal model. According to the LDoS attack detection method, the number of data packages reaching in certain time is counted through a structural characteristic value estimating matrix, the attack cycle of the LDoS is estimated, a statistic value is compared with a preset judgment characteristic value threshold for indicate differences between normal flow rate and mixed flow rate which includes the LDoS attack, and the differences serve as a basis for judging whether the LDoS attack exists or not. If the LDoS attack is judged to exist, the cycle value of the LDoS attack can be accurately calculated through the structural characteristic value estimating matrix. By means of the technical scheme, the LDoS attack can be effectively detected.

Description

technical field [0001] The invention relates to a computer network security technology, especially for the detection of low rate denial of service (LDoS) attack, which can detect the attack with high accuracy. Background technique [0002] Since the appearance of distributed denial of service DoS (Denial of Service) attack, it has been one of the biggest threats to network security. The traditional Flood type DoS (FDoS) attack is characterized by the need to maintain a high rate of attack flow, exhausting all available resources on the victim side. Low-rate distributed denial-of-service LDoS (Low-rate DoS) attack is a new type of DDoS attack. The principles of LDoS and FDoS are completely different. LDoS utilizes the security holes in the common adaptive mechanisms in network protocols or application services to periodically send a large number of attack packets in a specific short time interval. Thereby reducing the service performance of the attacked end. The characteri...

AI Technical Summary

Problems solved by technology

In 2003, at SIGCOMM, the top conference on computer networks, Aleksandar of Rice University first proposed a low-rate denial-of-service attack against the TCP protocol, mainly targeting the loopholes in the TCP congestion control mechanism, and proposed a potential low-rate denial-of-service attack Attack (Low-Rate Distributed Denial of Service, LDoS) attack model, through accurate calculation, only a small amount of attack data can lead to denial of service or degradation of service quality at the victim end

Because LDoS is different from traditional Flood DoS attacks, it has the characteristics of small traffic and is difficult to be detected by existing detection mechanisms, so it is more threatening and destructive to the network

However, so far, there are relatively few domestic studies on this attack method, and the information is very limited.

At the same time, the current detection methods all have certain deficiencies.

Images