Vanguard: A New Detection Scheme for a Class of TCP-targeted Denial-of-Service Attacks

Abstract

Abstract-A few low-rate, TCP-targeted Denial-ofService (DoS) attacks have been recently proposed, including the Shrew attack, Reduction of Quality (RoQ) attack, and Pulsing DoS (PDoS) attack. All of them use periodic attack pulses to throttle TCP flows. These attacks could potentially become major threats to the Internet's stabiliity and therefore they have motivated the development of a number of detection mechanisms for such attacks. However, those detection mechanisms are designed for specific attacks. Moreover, they assume that the period of the attack pulses is a nonzero constant. Unfortunately, these assumptions can be easily thwarted by more sophisticated attack strategies. In this paper, we propose a new detection system called Vanguard to identify a wide range of the aforementioned low-rate, DoS attacks, including the traditional flooding-based attacks as a special case. Vanguard can also detect attacks with randomized attack periods. We have validated Vanguard's efficacy based on extensive test-bed experiments. We have also compared Vanguard with other recently proposed detection systems.

A New Collaborative Detection Method for LDoS Attacks

“…As the DARPA99 datasets, the false-positive of this NCDM is also lower than the Vanguard method [7], as shown in Table III.…”

“…2) The MD control factor  and the MD detection operator 3  . Based on MD average () Mean MD and MD variance () Std MD of the training data,  is calculated as (9), and based on MDT average () Mean MDT and MDT variance () Std MDT of the training data, 3  is calculated as (10), where z is same as (7).…”

“…Currently, some progress has been made in the field of the LDoS detection methods [2,3], such as the min-TRO method [1], the wavelet analysis method [4], the DTW method [5], the HAWK method [6], the Vanguard method [7], Kai method [8] and so on [9,10]. For example, the Vanguard method [7] observed the traffic and measured the abnormal traffic, then used three parameters to judge the LDoS attacks. These proposed methods are still some deficiencies as the low accuracy, the high false-negative rate, the high false-positives rate, the weak reliability and so on.…”