One-way queuing delay measurement and its application on detecting DDoS attack

This paper presents a novel approach to measure and estimate end-to-end one-way queuing delay in a network, which carries information about traffic characteristics and congestion properties. The measurement results can be used to describe the normal behavior of the network and detect distributed denial-of-service attacks (DDoS attacks). The measurement does not require any synchronization between the two measurement ends. Pairs of probe packets are sent from the source to the destination and intra-gaps between the probes are separately measured at the two ends. By performing an iterative Fourier-to-time reconstruction algorithm on the measured intra-gaps, distribution of the end-to-end one-way queuing delay is estimated. The packet loss rate and delay jitter are simultaneously measured as well. The simulations and experiments are conducted to validate the approach.