Chaos-based detection of LDoS attacks

A low-rate denial of service (LDoS) attack behaves as a small signal in periodic pulses with low average rate, which hides in normal TCP traffic stealthily. LDoS attacks reduce link throughput and degrade QoS of a target. An approach of detecting LDoS attacks is proposed based on Duffing oscillator in chaos systems. The approach detects LDoS attacks by adopting the technology of digital signal processing (DSP), which takes an LDoS attack as a small signal and normal TCP traffic as background noise. Duffing oscillator is used to detect LDoS attacks in normal TCP traffic. Simulations show that the LDoS attacks can be detected through diagram of the chaotic state, and the period and pulse width of LDoS attacks can be estimated.

► A Duffing-oscillator based detection of LDoS attacks is proposed.
► The approach relies on the sensitivity to initial value and intermittent motion of Duffing oscillator.
► The network packets are analyzed to determine an LDoS attack.
► The LDoS attack is detected in frequency domain.