Is low‐rate distributed denial of service a great threat to the Internet?

Abstract

Low-rate Distributed Denial of Service (LDDoS) attacks, in which the attackers send packets to a victim at a sufficiently low rate to avoid being detected, are considered to be a subtype of DDoS attacks and a potential threat to Internet security. However, an overwhelming attack paradigm on the Internet has rarely been reported due to the harsh requirements for launching LDDoS attacks; therefore, most existing LDDoS attacks are constructed and evaluated through theoretical deduction and/or simulation tests. In this backdrop, the authors aim to figure out what the conditions for launching a successful LDDoS attack are, and how harmful an attack could be. They first analyse the characteristics of LDDoS attacks, and derive the conditions and parameters for initiating LDDoS attacks using a queuing model. Based on the analysis results, an LDDoS algorithm is presented. Then, an LDDoS validation prototype is built on a Network Function Virtualization network to validate the derived parameters and conditions. Finally, a series of experiments are conducted on the testbed, and the results show that a successful LDDoS attack could be achieved based on the derived algorithm; however, its attack effect only lasts for a short time compared with its DDoS counterparts.This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

Real-time Detection of Low-Rate DDoS Attacks in SDN-based Networks using Online Machine Learning Model

“…Low-rate Distributed Denial of Service (LDDoS) attacks have become a significant threat to network security due to their ability to evade traditional DDoS detection techniques [16]. LDDoS attacks operate at low traffic rates, which can go undetected by traditional detection methods.…”

Focus on Multipath TCP: Introduction, Benefits and Future Research Trends

“…On the basis of DDoS attacks, LDDoS attacks control puppet machine periodically sends small pulse traffic to the target host at a lower sending rate. When all pulses reach the target at the same time, they converge into a huge impact traffic to realize the attack [54]. Random network link failure may be caused by link disconnection, routing failure, wireless signal weakness and other factors.…”

Light-Weight Slow-Rate Attack Detection Framework for Resource-Constrained Industrial Cyber-Physical Systems

“…LDoS attacks differ from traditional Distributed Denial of Service (DDoS) attack in three ways: (1) These attacks have the same characteristics as legitimate network traffic, making them highly concealed and challenging to detect. (2) The average traffic rate is significantly low and the number of sent packets is extremely small; consequently, these attacks are challenging to detect with traditional mechanisms.…”

“…(3) LDoS attack utilises TCP/IP protocol's three-way handshake mechanism where control measures look normal; however, this can reduce the quality of service [1,2]. LDoS attack is categorized into Quality of Services (QoS), SRA, and Service-Queue attacks based on the damage to the protocols [3].…”