Low-rate Denial of service (LDoS) attacks has become one of the biggest threats to the Internet, cloud computing platforms, and big data centers. As an evolutionary species of DDoS attack, LDoS attack is essentially different from the DDoS attack. DDoS attacks are the behavior of malicious blocking legitimate network traffic by destroying the targets and the infrastructure around it with huge network traffic. While, LDoS attacks are the behavior of intentional degrading the quality of TCP links by throttling TCP flows to a small fraction of its ideal rate with periodic small pulse sequence. Hence, LDoS attack has a very small flow (around 10%-20% of the background traffic), it is easy to eluding the detection of routers and counter-DoS mechanisms. We try to reveal the mechanism of the LDoS attack and attempt to figure out the generation principle of LDoS attack in this paper. We classify the LDoS attacks and existing defense methods according to time domain and frequency domain in which detection and defense are performed. Furthermore, we highlight the filter approach to defense against LDoS attack. The initial purpose of our work is to encourage researchers to study effective ways to detect and defend against LDoS attacks with innovation and aggressiveness.

As the Software Define Network (SDN) adopts centralized control logic, it is vulnerable to various types of Distributed Denial of Service (DDoS) attacks. At present, almost all the research work focuses on high-rate DDoS attack against the SDN control layer. Moreover, most of the existing detection methods are effective for high-rate DDoS attack detection of the control layer, while a low-rate DDoS attack against the SDN data layer is highly concealed, and the detection accuracy against this kind of attack is low. In order to improve the detection accuracy of the low-rate DDoS attack against the SDN data layer, this paper studies the mechanism of such attacks, and then proposes a multi-feature DDoS attack detection method based on Factorization Machine (FM). The features extracted from the flow rules are used to detect low-rate DDoS attacks, and the detection of low-rate DDoS attacks based on FM machine learning algorithms is implemented. The experimental results show that the method can effectively detect the low-rate DDoS attack against the SDN data layer, and the detection accuracy reaches 95.80 percent. Because FM algorithm can achieve fine-grained detection for low-rate DDoS attack, which provides a reliable condition for defending against such attacks. Finally, this paper proposes a defense method based on dynamic deletion of flow rules, and carries out experimental simulation and analysis to prove the effectiveness of the defense method, and the success rate of forwarding normal packets reached 97.85 percent.

Denial of Service (DoS) attack is a serious threat to Software Defined Network (SDN). Although many research efforts have been devoted to identify new features for DoS attack detection, the existing approaches are not able to detect various types of DoS attacks. In SDN, DoS attacks against data plane are mainly organized in two ways: 1) DoS attack with multiple flow entries (M-DoS) to exhaust the Ternary Content-Addressable Memory (TCAM) resource of the switch. 2) DoS attack with a single well-designed entry (S-DoS) to overwhelm the target link and further impact the controller. To detect these two attacks, we propose a new approach by extracting six features of flow table, and using the back propagation (BP) neural network to construct the classifier. Test results of test-bed experiments indicate that the accurate detection probability of proposed approach is 98.9%, which can effectively distinguish M-DoS flows and S-DoS flows without being affected by Flash crowd scene.

Named Data Networking (NDN) is one of the main research projects of the information center network (ICN), and its efficient forwarding mechanism attaches the attention of researchers. Like other networks, NDN also faces the threat of cyber attacks. With the assistance of the colluding server, the Collusive Interest Flooding Attacks (CIFA) can use the defects of the NDN’s internal forwarding mechanism to send malicious interest packets in the form of pulses. It affects the normal requests of legitimate users and reduces the quality of NDN network services in this way. By analyzing the characteristics of network traffic and CIFA model, a new CIFA detecting method based on the prediction error between particle filter and one-step prediction algorithm is proposed. This scheme samples the network traffic and judges whether the network is under attack by comparing the normalized error value of the one-step prediction and the estimate of the particle filter. Experimental analysis shows that the detection scheme in this paper has higher detection rate than the existing detection schemes.

In Named Data Networking (NDN), Collusive Interest Flooding Attacks (CIFA) is a new type of Distributed Denial of Service (DDoS) attacks, which can effectively affect the performance of NDN by sending malicious Interests intermittently. Since the concealment of CIFA is strong, the existing detection methods for Interest Flooding Attacks (IFA) are difficult to find the malicious Interests in the NDN network. However, the subsequent attack strength of CIFA is weaker than that of IFA, resulting in the attack range of CIFA is much smaller than that of IFA in large network topologies. In order to launch the most serious attack with the least cost, the attack model of CIFA has been improved by our previous work, namely Improved Collusive Interest Flooding Attacks (I-CIFA). To better take the countermeasures against I-CIFA, this paper studies the adverse effects of I-CIFA in NDN and proposes a detection mechanism for I-CIFA. Foremost, we extract the corresponding network traffic and analyze the impact of I-CIFA on malicious routing nodes in different locations of the network. Furthermore, the detection mechanism based on BO-GBM fusion algorithm is proposed to detect I-CIFA through classifying the network traffic. Finally, several specific performance metrics are adopted to evaluate the practicability of BO-GBM fusion algorithm in detecting I-CIFA. The results show that BO-GBM fusion algorithm has better detection performance than other existing detection schemes, with the detection rate of 98.69%, false alarm rate of 1.36% and missing alarm rate of 1.43%.

The Automatic Dependent Surveillance-Broadcast (ADS-B) system uses air-to-air and air-to-ground data link broad-cast modes to transmit aviation aircraft position information at specific time intervals. Because the ADS-B broadcast channel is open, the access to the broadcast channel lacks a security au-thentication mechanism, and no information integrity protection measures are provided in the transmission protocol. Therefore, the aircraft position information broadcast by ADS-B can be easily and illegally tampered with illegally to form a counterfeit signal, which can cause an aircraft to suffer cyber-attacks. To ensure the authenticity and the integrity of the information, this paper adopts the concept of a trusted service and proposes a trusted service plan for anti-counterfeiting information in the ADS-B system based on blockchain technology. According to the structural characteristics and business service process of the ADS-B system, a suitable blockchain model is designed, an ADS-B message is recorded through the blockchain, and the immutable and traceable features of the blockchain are used to ensure the authenticity and reliability of data. After a user receives an ADS-B message, the data recorded in the blockchain are used as a reference in the form of a trusted service for the user to determine the counterfeit of the received data. A simulation verification shows that the proposed scheme can protect ADS- B information from being tampered with, can trace malicious nodes, can prevent data leakage, can provide systematic security protection, and has lower computational costs.