# Analyzing Impact and Systemwide Effects of the SlowROS Attack in an Industrial Automation Scenario
## 2 Related Work
### slow DoS  
slow DoS attacks are introduced in [6], defining them as \"denial of service attacks which make use of low attack bandwidth to accomplish their purpose\". Particularly, the aim of [6] is to properly categorize slow DoS attacks, considering available threats, born both in the wild and as a result of research activities. The work identifies a set of server timeouts the attacker can potentially exploit to deploy a successful slow DoS attack. Among these timeouts, the \(\Delta_{req}\) timeout, exploited by threats like Slowloris [7] or SlowComm [8], is the same timeout targeted by the threat subject of this work.  
Other work has instead been focused on targeting specific protocols. While the most popular attack in this context, Slowloris [9], is able to target HTTP/HTTPS only, other threats are aimed at disrupting different services. In this context, an evolution of Slowloris is proposed in [10], introducing a new threat targeting HTTP/2 by sending specific HTTP requests to the server. Differently, ref. [11] proposes SlowTT, a slow DoS attack targeting the MQTT protocol. By following a similar approach, in this paper, we aim at targeting the ROS protocol through a dedicated attack. Although a preliminary version of the work appears in [12], the current work extends the concept previously introduced by considering attack optimization strategies and by identifying, evaluating, and overcoming the limits of the previously introduced threat.  
Today, the protection from distributed slow DoS attacks represents an open research challenge. Even though identifying threats executed from a single malicious node is trivial [13], detecting distributed attacks is particularly challenging, as the network traffic they generate appears to be legitimate upon analysis [14]. In addition, as the payload exchanged during an ongoing attack complies with the exploited protocol, distinguishing between a malicious slow DoS scenario and a \"legitimate\" flash crowd is arduous [15]. Indeed, both situations generate a surge in traffic, making it difficult to differentiate between malicious intent and legitimate high-demand behavior [16].  
Although an efficient detection of slow DoS attacks is not straightforward, multiple research works propose solutions in this context. Particularly, refs. [7; 17; 18] propose a literature analysis on the topic, while [16] introduces a detection system able to distinguish flash crowds from denial of service attacks, by exploiting network flows correlation. Similarly, analogies between network flows are investigated in [19] for slow DoS detection purposes. Instead, ref. [20] introduces a detection system based on user behavior forecasting. As authors analyze traffic patterns and related delays, a malicious user may tune the attack to mimic user timings and exploit randomization techniques to bypass detection. Ref. [21] makes use of artificial intelligence algorithms to detect slow DoS attacks, also considering encrypted traffic. Other similar approaches consider deep learning [22; 23], fuzzy logic [24], or neural networks [25]. Most of the mentioned works focus on the ability to successfully identify an attack, without considering detection times. To this aim, ref. [13] proposes a detection system able to identify running slow DoS attacks shortly after it begins. Given the novelty of the SlowROS threat considered in this paper, although approaches similar to the ones mentioned could in principle be deployed to detect the attack, to the best of our knowledge, specific solutions able to efficiently identify a running SlowROS threat are still missing in the literature.