Low-Rate DoS Attacks Detection Based on MAF-ADM.

Area of Science:

• Computer Science
• Network Security
• Cybersecurity

Background:

• Low-rate denial of service (LDoS) attacks pose a significant threat to network availability.
• Their stealthy nature and low average traffic make them difficult for traditional detection mechanisms to identify.
• Existing methods struggle to effectively counter LDoS due to its subtle impact on network performance.

Purpose of the Study:

• To propose and evaluate an advanced anomaly detection method for identifying LDoS attacks.
• To leverage the time-frequency characteristics of network traffic for robust LDoS detection.
• To develop a system that effectively mitigates the impact of LDoS on network service quality.

Main Methods:

• An anomaly detection method based on adaptive fusion of multiple features (MAF-ADM) is proposed.
• Statistical metrics from the time-frequency joint distribution of Transmission Control Protocol (TCP) traffic are utilized.
• Isolation trees are generated to capture anomalies in both time and frequency domains, with results fused based on their isolation capabilities.
• A weighted moving average algorithm is employed for smoothing anomaly scores to reduce noise interference.

Main Results:

• The MAF-ADM method demonstrated effective detection of LDoS attacks across various experimental settings.
• Evaluations were conducted using Network Simulator 2 (NS2), a physical testbed, and public datasets (WIDE2018, LBNL).
• The proposed method achieved a lower false negative rate compared to existing approaches.

Conclusions:

• The MAF-ADM method provides an effective solution for detecting sophisticated LDoS attacks.
• Analyzing time-frequency joint distributions offers a promising avenue for identifying subtle network anomalies.
• The approach enhances network security by improving the detection accuracy and reducing false negatives for LDoS threats.