A fast self-similarity matrix-based method for shrew DDoS attack detection

摘要

Shrew DDoS attack mainly targets the TCP's retransmission timeout (RTO) mechanism that handles severe cases of congestion and packet losses. This attack is very hard to detect due to its stealthy nature and low-rate in volume which if remained undetected can affect the legitimate TCP flows. In this paper, we propose a fast shrew DDoS attack detection method based on self-similarity matrix (SSM) that measures the self-similarity of network traffic across multiple time scales over a subset of relevant features. The method can detect any presence of shrew attack inline with the incoming traffic samples and thus identify the attack flows. We experimented our method over real-life low-rate datasets for multiple scenarios and the results demonstrate its efficiency both in terms of detection accuracy and speed.