Detecting Low-rate DoS Attack Based On Union Feature

LDoS(Low-Rate Denial of Service, LDoS) attack is a kind of RoQ(Reduction of Quality, RoQ) attack. Network link is always in an unstable state because of LDoS’s short periodic pulse. In a result, the transmission quality is poor and the transmission efficiency is low. The LDoS attack flow is hidden in the network flow due to its low average rate, which makes it hard to detect. It is a great threat to the network security.According to the research of network flows, the feature of network throughput, loss rate end-to-end delay and packet numbers which have significant changes while LDoS attack happens are discussed. Three typical features of LDoS attack are extracted, and then an approach based on union-feature is proposed. These extracted features of LDoS attack are treated as the input the BP(Back Propagation) neural network. A well-trained BP neural network is considered as the classifier of LDoS attack and a proper decision-making indicator is set to detect LDoS attack in accuracy. The proposed detection approach is tested in NS-2and verified in Test-bed. Experimental results indicate that detection method based on union feature has a better detection performance than single feature. In addition, the validity of this detection approach is embodied. The detection probability is 94.15 percent which is derived from a large number of testing. The detection performance is better compared to other detection approach.