Exploring New Opportunities to Defeat Low-Rate DDoS Attack in Container-Based Cloud Environment

Li, Zhi; Jin, Hai; Zou, Deqing; Yuan, Bin

doi:10.1109/tpds.2019.2942591

Cited by 43 publications

(17 citation statements)

References 42 publications

(58 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(NFVs), in order to provide more robust and flexible ways of controlling resources for services. Li et al [35] provided a model and mitigation technique to detect and block low-rate attacks on container-based cloud services. They proposed the isolation into two parts of instances, where one part controls requests from a whitelist (legitimate traffic) and the other serves unknown requests (both malicious and benign requests).…”

Section: Related Workmentioning

confidence: 99%

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

et al. 2020

View full text Add to dashboard Cite

While there have been extensive studies of denial of service (DoS) attacks and DDoS attack mitigation, such attacks remain challenging to mitigate. For example, Low-Rate DDoS (LR-DDoS) attacks are known to be difficult to detect, particularly in a software-defined network (SDN). Hence, in this paper we present a flexible modular architecture that allows the identification and mitigation of LR-DDoS attacks in SDN settings. Specifically, we train the intrusion detection system (IDS) in our architecture using six machine learning (ML) models (i.e., J48, Random Tree, REP Tree, Random Forest, Multi-Layer Perceptron (MLP), and Support Vector Machines (SVM)) and evaluate their performance using the Canadian Institute of Cybersecurity (CIC) DoS dataset. The findings from the evaluation demonstrate that our approach achieves a detection rate of 95%, despite the difficulty in detecting LR-DoS attacks. We also remark that in our deployment, we use the open network operating system (ONOS) controller running on Mininet virtual machine in order for our simulated environment to be as close to real-world production networks as possible. In our testing topology, the intrusion prevention detection system mitigates all attacks previously detected by the IDS system. This demonstrates the utility of our architecture in identifying and mitigating LR-DDoS attacks. INDEX TERMS DDoS attack mitigation, Low-rate DDoS (LR-DDoS) attacks, Machine learning, Software-defined network (SDN).

show abstract

Section: Related Workmentioning

confidence: 99%

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

et al. 2020

View full text Add to dashboard Cite

show abstract

“…The average rate of LDDoS attack data flow is low and very similar to normal traffic, which can be completely hidden in normal background traffic and is not easily noticed. Because LDDoS attacks are more efficient and more harmful, it is difficult to be discovered by traditional DDoS/LDDoS attack defense systems, resulting in a rapid decline in network quality [14]. Currently, many networks do not have effective mechanisms to deal with threats from LDDoS attacks.…”

Section: Related Workmentioning

confidence: 99%

Extracting Low‐Rate DDoS Attack Characteristics: The Case of Multipath TCP‐Based Communication Networks

Lei

et al. 2021

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

The multipath TCP (MPTCP) enables multihomed mobile devices to realize multipath parallel transmission, which greatly improves the transmission performance of the mobile communication network. With the rapid development of all kinds of emerging technologies, network attacks have shown a trend of development with many types and rapid updates. Among them, low-rate distributed denial of service (LDDoS) attacks are considered to be one of the most threatening issues in the field of network security. In view of the current research status, by using the network simulation software NS2, this paper first compares and analyzes the throughput and delay performance of the MPTCP transmission system under LDDoS attacks and, further, conducts simulation experiments and analysis on the queue occupancy rate of the LDDoS attack flow to extract the basic attack characteristics of the LDDoS attacks. The experimental results show that the LDDoS attacks will have a major destructive effect on the throughput performance and delay performance of the MPTCP transmission system, resulting in a decrease in the robustness of the transmission system. By analyzing and comparing the occupancy rate of the LDDoS attack flow in the MPTCP transmission system, it can be concluded that (1) the occupancy rate of the LDDoS scattered pulse traffic sent by each puppet machine changes slightly, and (2) the occupancy rate of LDDoS attack data flow is much greater than that of ordinary TCP data flow.

show abstract

“…Siracusano et al presented a methodology for the detection of LDDoS attacks based on characteristics of malicious TCP flows [13]. Li et al considered the LDDoS attacks in the container-based cloud environment [14]. Sahoo et al presented a DDoS attack detection method in software-defined networking (SDN)based data centre networks using information distance metrics [15].…”

Section: Related Workmentioning

confidence: 99%

Is low‐rate distributed denial of service a great threat to the Internet?

Chen

Wei

et al. 2021

IET Information Security

View full text Add to dashboard Cite

Low-rate Distributed Denial of Service (LDDoS) attacks, in which the attackers send packets to a victim at a sufficiently low rate to avoid being detected, are considered to be a subtype of DDoS attacks and a potential threat to Internet security. However, an overwhelming attack paradigm on the Internet has rarely been reported due to the harsh requirements for launching LDDoS attacks; therefore, most existing LDDoS attacks are constructed and evaluated through theoretical deduction and/or simulation tests. In this backdrop, the authors aim to figure out what the conditions for launching a successful LDDoS attack are, and how harmful an attack could be. They first analyse the characteristics of LDDoS attacks, and derive the conditions and parameters for initiating LDDoS attacks using a queuing model. Based on the analysis results, an LDDoS algorithm is presented. Then, an LDDoS validation prototype is built on a Network Function Virtualization network to validate the derived parameters and conditions. Finally, a series of experiments are conducted on the testbed, and the results show that a successful LDDoS attack could be achieved based on the derived algorithm; however, its attack effect only lasts for a short time compared with its DDoS counterparts.This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

show abstract

Exploring New Opportunities to Defeat Low-Rate DDoS Attack in Container-Based Cloud Environment

Cited by 43 publications

References 42 publications

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning

Extracting Low‐Rate DDoS Attack Characteristics: The Case of Multipath TCP‐Based Communication Networks

Is low‐rate distributed denial of service a great threat to the Internet?

Contact Info

Product

Resources

About