A fast self-similarity matrix-based method for shrew DDoS attack detection. Issue 2 (3rd March 2020)

• Record Type: Journal Article
• Authors: Boro, Debojit; Haloi, Mrinmoy; Bhattacharyya, Dhruba K
• Is Part Of: Information security journal. Volume 29:Issue 2(2020)
• Page Start: 73
• Page End: 90
• Publication Date: 2020-03-03
• Subjects: Low-rate DDoS (LRDDoS) attack -- retransmission timeout (RTO) -- self-similar -- self-similarity matrix (SSM) -- shrew DDoS attack; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1080/19393555.2020.1715514
• Languages: English
• ISSNs: 1939-3555

Abstract

ABSTRACT: Shrew DDoS attack mainly targets the TCP's retransmission timeout (RTO) mechanism that handles severe cases of congestion and packet losses. This attack is very hard to detect due to its stealthy nature and low-rate in volume which if remained undetected can affect the legitimate TCP flows. In this paper, we propose a fast shrew DDoS attack detection method based on self-similarity matrix (SSM) that measures the self-similarity of network traffic across multiple time scales over a subset of relevant features. The method can detect any presence of shrew attack in-line with the incoming traffic samples and thus identify the attack flows. We experimented our method over real-life low-rate datasets for multiple scenarios and the results demonstrate its efficiency both in terms of detection accuracy and speed.