Spectral Analysis of TCP Flows for Defense Against Reduction-of-Quality Attacks

Y. Chen, K. Hwang
2007 2007 IEEE International Conference on Communications  
The RoQ (Reduction-of-Quality) attacks are lowrate DDoS attacks that degrade the QoS to end systems stealthily but not to deny the services completely. These attacks are more difficult to detect than the flooding DDoS attacks. This paper explores the energy distributions of Internet traffic flows in frequency domain. Normal TCP traffic flows present periodicity because of protocol behavior. Our results reveal that normal TCP flows can be segregated from malicious flows according to energy
more » ... ing to energy distribution properties. We discover the spectral shifting of attack flows from that of normal flows. Combining flow-level spectral analysis with sequential hypothesis testing, we propose a novel defense scheme against RoQ attacks. Our detection and filtering scheme can effectively rescue 99% legitimate TCP flows under the RoQ attacks.
doi:10.1109/icc.2007.204 dblp:conf/icc/ChenH07 fatcat:zlmppynot5bgtojxykmprnsbam