Low-rate denial of service(LDoS)is a new class of DoS attack

which exploits the deficiencies of the minimum RTO of TCP to send out attack packets about 10%-20% of normal traffic in short periodic pulses to a victim.It is hard to be detected through traditional detection mechanism.In this paper

an approach of detecting LDoS attack based on the model of small signal is proposed.The proposed approach takes statistics on the packets arriving in 30 seconds (sampling time is 10ms

total of 3000 sampling points)

and compares the statistical result with the characteristic judging value

which is settled as a threshold to indicate the difference between normal and attack flow.An eigenvalue-estimating matrix is established to estimate the attack period after LDoS attack being detected.Simulation results in NS-2 environment show that the proposed approach can detect the LDoS attack effectively.