TCP Low Rate DDoS Attack Detection

Distributed Denial of Service (DDoS) is one of the more important attacks in computer networks. DDoS attackscan be categorized in to two categories: high rate and low rate. In the high rate DDoS category, the attacker tries to fillup the entire link's bandwidth capacity by flooding the link with packets. On the other hand, in the low rate DDoScategory (i.e. LDDoS), the attacker executes a DDoS attack while keeping a low average transmission rate. TCPLDDoS is a low rate DDoS attack in which the attacker exploits the TCP congestion control behavior. In this paper, weinvestigate a system for defending against the TCP LDDoS attack and propose a novel method for doing so. We presentsome observation for distinguishing between legitimate and attack behavior. The output of our system is a priorityqueue containing flows so that high priority flows are legitimate and low priority flows are suspicious. We evaluate theproposed system employing the NS2 simulation environment. Results show that our proposed system is able to detectattack flows from legitimate flows properly

کلیدواژه ها:

Network Security ، TCP Low rate attack ، DDoS ، Encountering ، TCP