Description

Low-rate denial of service (LDoS) attacks send periodic pulsesequences with relative low rate to form aggregationflows at the victim end. LDoS attack flows have the characteristics of low average rate and great concealment. It is hard todetect LDoS attack flows from normal traffic due to low rate property. Network traffic measurement shows that aggregatenetwork traffic is multifractal. In order to characterize and analyze network traffic, researchers have developed concisemathematical models to explore complex multifractal structure. Although the LDoS attack flows are very small, it will inevitablylead to the change of multifractal characteristics of network traffic. This paper targets at exploiting and estimating the changes inmultifractal characteristics of network traffic for detecting LDoS attack flows. The algorithm of multifractal detrended fluctuationanalysis (MF-DFA) is used to explore the change in terms of multifractal characteristics over asmall scale of network trafficdueto LDoS attacks. Through wavelet analysis, the singularity and bursty of network traffic under LDoS attacks are estimated byusing Hölder exponent. The difference values (D-value) of Hölder exponent of network traffic between normal and under LDoSattack situations are calculated. The D-value is used as the basis to determine LDoS attacks. A detection threshold is set basedon the statistical results. The presence of LDoS attacks can beconfirmed through comparing D-value with detection threshold.Experiments on detection performance have been performed in thetest-bed network and simulation platform. The extensiveexperimental results are congruent with the theoretical analysis.