Low rate TCP denial-of-service attack detection at edge routers
Document Type
Article
Publication Date
1-1-2005
Abstract
Low rate TCP Denial-of-Service attacks are a new type of DoS attacks that are carefully orchestrated to exploit the fixed minimum TCP RTO property, and thereby deny services to legitimate users. This type of attacks is different from traditional flood-based attacks, and hence conventional solutions to detect these attacks are not applicable. We propose a novel approach to detect these attack flows at edge routers. A flow exhibiting a periodic pattern is marked malicious if its burst length is greater than or equal to RTTs of other connections with the same server, and its time period is equal to the fixed minimum RTO. A carefully designed light weight data structure is proposed to store the necessary flow history at edge routers. Simulation results show that such flows can be detected by our proposed approach, which does not require any modification to TCP congestion control algorithms like randomizing the fixed minimum RTO. © 2005 IEEE.
Identifier
17744370129 (Scopus)
Publication Title
IEEE Communications Letters
External Full Text Location
https://doi.org/10.1109/LCOMM.2005.1413635
ISSN
10897798
First Page
363
Last Page
365
Issue
4
Volume
9
Fund Ref
State of New Jersey Commission on Science and Technology
Recommended Citation
Shevtekar, Amey; Anantharam, Karunakar; and Ansari, Nirwan, "Low rate TCP denial-of-service attack detection at edge routers" (2005). Faculty Publications. 19845.
https://digitalcommons.njit.edu/fac_pubs/19845
