A Low-Rate DoS Attack Detection Method Based on Hilbert Spectrum and Correlation

Abstract

To date, Denial of Service (DoS) attack still causes great damage to the Internet in spite of many years' research on its detection and defense. Low-rate Denial of Service (LDoS) attack, a new type of DoS attack, exploits the congestion control mechanism of Transmission Control Protocol (TCP) to degrade the throughput of network by sending periodic pulse attack traffic. The periodic mechanism applied by LDoS makes its average attack traffic speed very low compared to DoS attack, which means existing DoS detection methods based on high attack traffic speed are incapable of detecting LDoS attack. In this paper, we propose a correlation-based approach to detect LDoS attack. The major innovation of the correlation-based approach is that, instead of calculating the correlation coefficient of network traffic sequence directly, it calculates the correlation coefficient of the Hilbert Spectrum of the network traffic. The Hilbert Spectrum, obtained by applying Hilbert-Huang Transform to the network traffic, is an energy-frequency-time distribution which presents more information about the network traffic than raw network traffic sequences. We conduct NS-2 simulations, public dataset experiments to evaluate the performance of the proposed approach. The experimental results show that the approach can detect LDoS attack effectively.