Abstract:

Low-Rate Denial-of-Service (LDoS) attacks exploit vulnerabilities in network protocols’ adaptive mechanisms, causing these mechanisms to fail in a legitimate manner, significantly reducing bandwidth utilization and quality of service. Therefore, the high concealment and destructive nature of LDoS attacks make them an important research topic in the field of network security.Aiming at the concealment of complex low-rate denial-of-service (LDoS) attacks across multiple network layers and the limitations of traditional detection methods in sampled traffic scenarios, this paper proposes an LDoS attack detection method based on HLD-Sketch (Hybrid-LDoS-Detect-Sketch). The study covers the detection of transport-layer LDoS attacks, application-layer LDoS attacks, and hybrid multi-layer attack under sampling conditions. First, an improved CM-Sketch structure is introduced to dynamically estimate flow lengths and adaptively adjust sampling probabilities, prioritizing fine-grained sampling for short flows to reduce interference from long-flow background noise during attack feature extraction. Second, leveraging the lightweight nature of CM-Sketch, multidimensional temporal statistical features, such as flow rate, the number of upstream and downstream packets, and port dispersion, are efficiently extracted from the sampled traffic Finally, a machine learning classifier is employed to hierarchically detect transport-layer, application-layer, and hybrid attacks. Experimental results demonstrate that the proposed method achieves a detection accuracy of 99.94% with a 3% sampling rate within 6 seconds, even in hybrid attack scenarios. This approach provides a lightweight solution for real-time detection of multi-dimensional LDoS attacks in high-speed network environments, particularly suited for resource-constrained scenarios with large-scale traffic.

Key words: LDoS, sketch, dynamic flow sampling, multi-dimensional temporal features, lightweight detection