1

Early Detection of LDDoS Attacks in IoT
Utilizing Locality Sensitive Incremental TSVM
MethodXiaochun Yin*, Zengguang Liu**, Deyong Liu***, Zhenge Liu*****Blockchain Laboratory of Agricultural Vegetables, Weifang University of Science & Technology, Shouguang,Weifang, Shandong, China**College of Computer Science and Engineering, Shandong University of Science and Technology, Qingdao,Shandong, China***Shandong Software Engineering Technology Center, Weifang University of Science & Technology,
Shouguang, Weifang, Shandong, China****School of Software & Microelectronics, Peking University, Beijing, China
xiaochunyin@wfust.edu.cn, st.lzg@163.com, gm@univalsoft.com, 1931087307@qq.com

Corresponding Author: Zengguagn Liu (st.lzg@163.com), Tel: +86 18853688750
Abstract—The Mirai botnet and its variants has made Internet of Things (IoT) devices a powerful amplifying platform for Low-rate
Distributed Denial-of-Service (LDDoS) attacks. In this paper, we firstly propose a new low-rate variant, which is a sophisticatedcrossfire low-rate DDoS attack mechanism. At the same time, we investigate and develop a novel semi-supervised Locality Sensitive
Incremental Transductive Support Vector Machine (LS-ITSVM) method. The proposed method maximizes the margins of different
network flows by incorporating local frequency-domain features from the autocorrelation sequence of network flow into theregularization time-domain framework of TSVM. And it saves training and detecting time by incremental training support vectors
and new added samples. In experiments, we verify the proposed crossfire LDDoS is more concealed and harmful firstly. Then, theresult in public dataset proves the proposed method can distinguish abnormal network flows with higher detection accuracy, fastertraining and response time, and prevent abnormal network flow groups with less impaction. At last, the results in private testbed prove
LS-ITSVM is still available to new LDDoS variants.
Keyword—LDDoS, Internet of Things, Locality Sensitive Incremental TSVM, Frequency-Domain Features, Semi-Supervised
Clustering
Xiaochun Yin (M’12) was born in Shouguang, China in 1980. She received the B.S. degree in Education and Technology from Qufu
Normal University in 2004, and received the M.S. degree in Education and Technology from Nanjing Normal University in 2007, andreceived the Ph.D. from Dongseo University in 2015.
From 2007 to now, she is an associate professor in Weifang University of Science &Technology. Her research interests include
network security, IoT security, blockchain and AI areas.
Professor Yin was a recipient of the Science Research Innovation Award of Weifang University of Science & Technology in 2017 and2018.

Zengguang Liu was born in Shouguang, China in 1982. He received the B.S. and M.S. degrees in computer science from theUniversity of Shanghai for Science and Technology in 2005 and 2008 respectively. He is currently pursuing the Ph.D. degree incomputer science at the University of Shandong for Science and Technology.
From 2008 to 2016, he was a Senior Architecture Engineer in Core Network Department of Alcatel-Lucent. He had been a Principal
AI Engineer of Hewlett Packard Enterprise since 2016. His research interests include big data, AI and network security areas.
He was a recipient of the Innovation Award of Shandong for Excellence in 2011.

2Deyong Liu received the B.S. degree in computer science and technology from Shandong Normal University in 1996 and the M.S.
degree in computer technology from Ocean University of China in 2010.
He is currently a Professor with the Weifang University of Science & Technology. He is focusing on Cloud Computing, IoT, andSmart city big data research. At present, he is the tutor of Shandong Normal University, the tutor of the Torch High-tech Industry
Development Center of the Ministry of Science and Technology, the director of Shandong Software Industry Association.

Zhenge Liu received the B.S. degree in QingDao University in 2020, majoring in accounting. He is now studying in Peking University
for software engineering.
He is now engaged in research cloud computing, IoT, and machine learning algorithm for paired financial trading.