LDoS Attacks Detection Based On Multifractal

LDoS(Low-rate Denial of Service) attack is a new type of DoS attack. LDoS attacks send periodic pulse sequences exploiting adaptive mechanism of network, which has the characteristics of low average rate and great concealment so that the victim will long be in the low quality of service( QoS) and cannot be found easily.It has been found the network traffic has the similarity phenomena over large time scale and multifractal phenomena over small time scale. LDoS attacks send a large number of packets flooding the network links, which will change the multifractal characteristic of network traffic, and the Holder exponent that is an eigenvalue of network traffic will be changed. A detection method based on multifractal for LDoS attacks on the basis of abnormal change of Holder exponent is proposed in this paper. MF-DFA method is used to analyze the network traffic to verify the multifractal characteristic of network traffic, and then the method of estimating Holder exponent based on wavelet analysis is proposed. The difference value(D-value) of Holder exponent in network traffic between normal and under LDoS attack situations is calculated. The D-value is used as the basis to determine LDoS attacks. A detection threshold is set based on the statistical results. The presence of LDoS attacks can be confirmed through comparing D-value with detection threshold. If the D-value is higher than threshold?, there is LDoS attack, whereas, there is no LDoS attack. To determine further the beginning or the ending of LDoS attacks, t hypothesis test is used. The test results show that the detection probability can reach more than 90% with low time complexity in NS2 platform and test-bed environment.