Detecting Low-Rate DoS Attacks Based on Signal Cross-Correlation

WU Zhi-jun; LI Guang; YUE Meng

doi:10.3969/j.issn.0372-2112.2014.09.015

您当前的位置：

首页 >

文章列表页 >

Detecting Low-Rate DoS Attacks Based on Signal Cross-Correlation

更新时间：2025-07-16

- Detecting Low-Rate DoS Attacks Based on Signal Cross-Correlation
- Acta Electronica Sinica Vol. 42, Issue 9, Pages: 1760-1766(2014)
- 作者机构：
  
  中国民航大学电子信息工程学院天津市高级信号处理重点实验室,天津,300300
- 作者简介：
- 基金信息：
- DOI：10.3969/j.issn.0372-2112.2014.09.015
  CLC： TP393.4
- Published：2014
- 稿件说明：
移动端阅览
WU Zhi-jun, LI Guang, YUE Meng. Detecting Low-Rate DoS Attacks Based on Signal Cross-Correlation[J]. Acta Electronica Sinica, 2014, 42(9): 1760-1766.
DOI：

WU Zhi-jun, LI Guang, YUE Meng. Detecting Low-Rate DoS Attacks Based on Signal Cross-Correlation[J]. Acta Electronica Sinica, 2014, 42(9): 1760-1766. DOI： 10.3969/j.issn.0372-2112.2014.09.015.

摘要

低速率拒绝服务LDoS（Low-rate Denial of Service）攻击是一种基于TCP/IP协议漏洞，采用密集型周期性脉冲的攻击方式.本文针对分布式LDoS攻击脉冲到达目标端的时序关系，提出基于互相关的LDoS攻击检测方法.该方法通过计算构造的检测序列与采样得到的网络流量序列的相关性，得到相关序列，采用基于循环卷积的互相关算法来计算攻击脉冲经过不同传输通道在特定的攻击目标端的精确时间，利用无周期单脉冲预测技术估计LDoS攻击的周期参数，提取LDoS攻击的脉冲持续时间的相关性特征，并设计判决门限规则.实验结果表明基于信号互相关的LDoS攻击检测方法具有较好的检测性能.

Abstract

Low-rate Denial of Service (LDoS) attack is TCP-targeted attack

which attempts to deny bandwidth of TCP flows.LDoS attacks send intensive periodic pulses at sufficiently low average rate to elude detection of DoS defense system.Based on the sequence relation between the distributed LDoS attack pulses arriving at the destination

a cross-correlation LDoS attack detection method is proposed by using cyclic convolution.This method builds a detection sequence for the purpose of exploring the timing relationship for distributed LDoS attack pulses arriving at the specific destination.Through computing the relation between the constructed detection sequence and sampled network flow sequence

the cross sequence is obtained.The cyclic convolution cross-relation algorithm is utilized to compute the precise time that the attack pulses arriving at the specific destination through different transferring channels.With nonperiodic monopulse prediction technology

the periodic parameters of LDoS attack are estimated

the relation characteristic of the pulse durations of LDoS attacks is extracted

and the threshold rules are designed.Experimental results show that the proposed algorithm of LDoS attack detection based on signal correlation achieves good detection performance.

关键词

Keywords

references

Views

1566

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

The Detection of LDoS Attack Based on the Model of Small Signal

Review of Recent Advancement of Molecular Communication

QR Code Detection and Recognition Algorithm for Industrial Control

A Novel Detection Algorithm of Dim Signal Based on Instantaneous Polarization

Related Author

WU Zhi-jun

PEI Bao-song

YAN Hao

LIU Fu-qiang

KONG Lei

LIN Lin

HUANG Li

SUN Han

Related Institution

中国民航大学电子信息工程学院智能信号与图像处理天津市重点实验室

China Mobile Research Institute

School of Electronic Science and Engineering, Tongji University

School of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University

College of Information Science and Technology,Nanjing University of Aeronautics and Astronautics

⁰