Abstract-The shrew Distributed Denial of Service (DDoS) attacks are periodic, bursty, and stealthy in nature. They are also known as Reduction of Quality (RoQ) attacks. Such attacks could be even more detrimental than the widely known flooding DDoS attacks because they damage the victim servers for a long time without being noticed, thereby denying new visitors to the victim servers, which are mostly e-commerce sites. Thus, in order to minimize the huge monetary losses, there is a pressing need to effectively detect such attacks in real-time. Unfortunately, effective detection of shrew attacks remains an open problem. In this paper, we meet this challenge by proposing a new signal processing approach to identifying and detecting the attacks by examining the frequency-domain characteristics of incoming traffic flows to a server. A major strength of our proposed technique is that its detection time is less than a few seconds. Furthermore, the technique entails simple software or hardware implementations, making it easily deployable in a real-life network environment. Index Terms-Network security, distributed denial of service (DDoS), reduction of quality (RoQ), digital signal processing (DSP), Internet traffic analysis
Yu Chen, Kai Hwang, and Yu-Kwong Kwok have done the relevant work REF .They identify and detect attacks by proposing new signal processing methods to address this challenge by checking the frequency domain characteristics of the server's inbound flow.
Filtering of shrew DDoS attacks in frequency domain
The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l
The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l
Computer Science