Detecting Pulsing Denial-of-Service Attacks with Nondeterministic Attack Intervals. (2nd March 2009)

• Record Type: Journal Article
• Authors: Luo Luo, Xiapu Xiapu; Chan Chan, Edmond W. W. Edmond W. W.; Chang Chang, Rocky K. C. Rocky K. C.
• Other Names: Huang Huang Chin-Tser Chin-Tser Academic Editor.
• Is Part Of: EURASIP journal on advances in signal processing. Volume 2009(2009)
• Publication Date: 2009-03-02
• Subjects: Signal processing -- Periodicals; Traitement du signal; Signal processing; Periodicals; 621.3822
• DOI: 10.1155/2009/256821
• Languages: English
• ISSNs: 1687-6172

Abstract

Abstract : This paper addresses the important problem of detecting pulsing denial of service (PDoS) attacks which send a sequence of attack pulses to reduce TCP throughput. Unlike previous works which focused on a restricted form of attacks, we consider a very broad class of attacks. In particular, our attack model admits any attack interval between two adjacent pulses, whether deterministic or not. It also includes the traditional flooding-based attacks as a limiting case (i.e., zero attack interval). Our main contribution is Vanguard, a new anomaly-based detection scheme for this class of PDoS attacks. The Vanguard detection is based on three traffic anomalies induced by the attacks, and it detects them using a CUSUM algorithm. We have prototyped Vanguard and evaluated it on a testbed. The experiment results show that Vanguard is more effective than the previous methods that are based on other traffic anomalies (after a transformation using wavelet transform, Fourier transform, and autocorrelation) and detection algorithms (e.g., dynamic time warping).