AbsIroct -We propose using spectral analysis to identify normal TCP traffic so that it will not be dropped or rate-limited in defense against denial of service (DOS) attacks. The approach can reduce false positives of attacker identification schemes and thus decrease the associated unnecessary slowdown or stoppage of legitimate traffic. For the spectral analysis, we use the number of packet arrivals of e flow in fired-length time intervals as the signal. We then estimate the power spectral density of the signal, in which information of periodicity, or lack thereof, in the signal reveals itself. A normal TCP flow should exhibit strong periodicity around its round-trip time in both flow directions, whereas an attack flow usuaUy does not. We validate the effectiveness of the approach with simulation and trace analysis. We argue that the approach complements existing DOS defense mechanisms that focus on identifying attack traffic.
As regards approaches more related to the time-frequency domain, Cheng et al. REF propose the use of spectral analysis to identify legitimate TCP flows, which should exhibit strong periodicity.
Use of spectral analysis in defense against DoS attacks
Global Telecommunications Conference, 2002. GLOBECOM '02. IEEE
Global Telecommunications Conference, 2002. GLOBECOM '02. IEEE
Computer Science