Detection of LDDoS Attacks Based on TCP Connection Parameters
This addresses the challenge of accurately identifying LDDoS attacks for webserver security without degrading service quality for legitimate users, representing an incremental improvement in detection methods.
The paper tackled the problem of detecting low-rate application layer distributed denial of service (LDDoS) attacks, which are stealthy and can bypass existing defenses, by proposing a methodology based on TCP flow characteristics and achieved up to 99.99% classification accuracy using decision trees and k-NN algorithms.
Low-rate application layer distributed denial of service (LDDoS) attacks are both powerful and stealthy. They force vulnerable webservers to open all available connections to the adversary, denying resources to real users. Mitigation advice focuses on solutions that potentially degrade quality of service for legitimate connections. Furthermore, without accurate detection mechanisms, distributed attacks can bypass these defences. A methodology for detection of LDDoS attacks, based on characteristics of malicious TCP flows, is proposed within this paper. Research will be conducted using combinations of two datasets: one generated from a simulated network, the other from the publically available CIC DoS dataset. Both contain the attacks slowread, slowheaders and slowbody, alongside legitimate web browsing. TCP flow features are extracted from all connections. Experimentation was carried out using six supervised AI algorithms to categorise attack from legitimate flows. Decision trees and k-NN accurately classified up to 99.99% of flows, with exceptionally low false positive and false negative rates, demonstrating the potential of AI in LDDoS detection.