Use of spectral analysis in defense against DoS attacks

22 December 2003

conference paper
Published by Institute of Electrical and Electronics Engineers (IEEE)

Vol. 3, 2143-2148
https://doi.org/10.1109/glocom.2002.1189011

Abstract

We propose using spectral analysis to identify normal TCP traffic so that it will not be dropped or rate-limited in defense against denial of service (DoS) attacks. The approach can reduce false positives of attacker identification schemes and thus decrease the associated unnecessary slowdown or stoppage of legitimate traffic. For the spectral analysis, we use the number of packet arrivals of a flow in fixed-length time intervals as the signal. We then estimate the power spectral density of the signal, in which information of periodicity, or lack thereof, in the signal reveals itself. A normal TCP flow should exhibit strong periodicity around its round-trip time in both flow directions, whereas an attack flow usually does not. We validate the effectiveness of the approach with simulation and trace analysis. We argue that the approach complements existing DoS defense mechanisms that focus on identifying attack traffic.

Keywords

This publication has 4 references indexed in Scilit:

Managing the Threat of Denial-of-Service Attacks
Published by Defense Technical Information Center (DTIC) ,2001
Fourier Analysis of Time Series
Wiley Series in Probability and Statistics, 2000
On the self-similar nature of Ethernet traffic
Published by Association for Computing Machinery (ACM) ,1993
Congestion avoidance and control
ACM SIGCOMM Computer Communication Review, 1988