 |
In phase three, with more and more feasible detection methods for above high rate DDoS, it begins to hide it as low rate one, and is becoming a serious threat to Internet. As we know, a successful DDoS attack needs to tune a tuple (T, R, L) of TCP at least. T is an integer multiple coincides with minRTO value of TCP; R is the peak rate and L is the burst length. In order to cause TCP packet loss and begin slow-start, R should be large enough and L should be longer than RTT value. In this picture, we simulated a LDDoS attacks of 4 Mirai Bots with the R of 50Kb/sec. Obviously, we can see that the LDDoS attack stream hides itself among normal traffic by making its peak rate even lower than the normal traffic rate. it is becoming harder and harder to be detected. In our paper, we will propose a method with high detection accuracy, fast response time to detect LDDoS Attacks. |
IEEE/ICACT20210143 Slide.04
[Big Slide]