Sequence alignment detection of TCP-targeted synchronous low-rate DoS attacks
Sequence alignment detection of TCP-targeted synchronous low-rate DoS attacks
复制标题
针对 TCP 的同步低速率 DoS 攻击的序列对齐检测
DOI：
10.1016/j.comnet.2019.01.031
复制
发表时间：
2019-04
影响因子：
5.6
通讯作者：
Liu Liang
中科院分区：
文献类型：
--
作者：
Wu Zhijun;Pan Qingbo;Yue Meng;Liu Liang
以TCP为目标的低速率拒绝服务（LDoS）攻击以足够低的平均速率发起周期性流，在攻击端完全传播成大的网络流量。因此，LDoS攻击流量具有显著的周期性、低传输速率和广泛的分布。本文从序列匹配的角度研究了LDoS攻击的特征。通过对受害端分布式LDoS攻击脉冲序列相似性的分析，发现生物信息学中的序列比对检测技术可以用于检测LDoS攻击流。提出了一种基于Smith-Waterman局部序列比对算法的LDoS攻击检测方法。该方法将局部构造的检测序列与背景流进行比较，特别是以构造的检测序列的脉冲周期、长度和幅度3个特征作为基准，准确估计LDoS攻击的特征参数。设计了双阈值规则，并与计算出的最大相似度分值进行了比较。从而达到检测LDoS攻击的目的。我们建立了一个仿真平台和测试床，以验证所提出的方法。分别设计了仿真平台和搭建了实验床，对所提方法的性能进行了测试和验证。实验结果表明，该方法具有较高的准确率和F1得分。
TCP-targeted Low-rate Denial of Service (LDoS) attack launches periodic flows at a sufficiently low average rate that completely spread into large network traffic at the attack end. Hence, LDoS attack traffic has significant periodicity, low transmission rate, and wide distribution. This paper investigates the characteristics of LDoS attacks from a sequence matching perspective. Based on the analysis of sequence similarity between distributed LDoS attack pulses at the victim end, we find that the technique of sequence alignment detection in bioinformatics can be used to detect LDoS attack flows. We presented an approach of LDoS attack detection by using the Smith-Waterman local sequence alignment algorithm that obtaining the similarity score of two sequences. Through this approach, the locally constructed detection sequence is compared with the background flow, especially the three characteristics of the pulse period, length and amplitude of the constructed detection sequence are used as benchmarks to accurately estimate the characteristic parameters of the LDoS attack. A double threshold rule is designed and compared with the calculated maximum similarity score value. Thereby achieving the purpose of detecting an LDoS attack. We build a simulation platform and test-bed to validate the proposed approach. We designed the simulation platform and built the test-bed separately to test and verify the performances of the proposed approach. Experimental results show that this proposed approach has high accuracy and F1 score.
登录
查看更多内容
DOI：
10.1016/b978-0-12-131200-8.50031-9
发表时间：
1989
期刊：
--
影响因子：
--
作者：
S. B. Needleman;C. D. Wunsch
通讯作者：
S. B. Needleman;C. D. Wunsch
DOI：
10.1109/lcomm.2012.121912.122257
发表时间：
2013-01
期刊：
IEEE Communications Letters
影响因子：
--
作者：
Wei Wei-Wei;F. Chen;Yingjie Xia;Guang Jin
通讯作者：
Wei Wei-Wei;F. Chen;Yingjie Xia;Guang Jin
DOI：
10.3969/j.issn.0372-2112.2014.09.015
发表时间：
2014
期刊：
--
影响因子：
--
作者：
吴志军;岳猛;李光
通讯作者：
吴志军;岳猛;李光
DOI：
10.1109/lcomm.2013.022713.122652
发表时间：
2013-03
期刊：
IEEE Communications Letters
影响因子：
--
作者：
Xianliang Jiang;Jiangang Yang;Guang Jin;Wei Wei-Wei
通讯作者：
Xianliang Jiang;Jiangang Yang;Guang Jin;Wei Wei-Wei
基于网络多重分形的低速率DoS攻击检测
DOI：
10.1109/tdsc.2015.2443807
发表时间：
2016-09-01
影响因子：
7.3
作者：
Wu, Zhijun;Zhang, Liyuan;Yue, Meng
通讯作者：
Yue, Meng