Low-rate Denial of service (LDoS) attacks has become one of the biggest threats to the Internet, cloud computing platforms, and big data centers. As an evolutionary species of DDoS attack, LDoS attack is essentially different from the DDoS attack. DDoS attacks are the behavior of malicious blocking legitimate network traffic by destroying the targets and the infrastructure around it with huge network traffic. While, LDoS attacks are the behavior of intentional degrading the quality of TCP links by throttling TCP flows to a small fraction of its ideal rate with periodic small pulse sequence. Hence, LDoS attack has a very small flow (around 10%-20% of the background traffic), it is easy to eluding the detection of routers and counter-DoS mechanisms. We try to reveal the mechanism of the LDoS attack and attempt to figure out the generation principle of LDoS attack in this paper. We classify the LDoS attacks and existing defense methods according to time domain and frequency domain in which detection and defense are performed. Furthermore, we highlight the filter approach to defense against LDoS attack. The initial purpose of our work is to encourage researchers to study effective ways to detect and defend against LDoS attacks with innovation and aggressiveness.

As the Software Define Network (SDN) adopts centralized control logic, it is vulnerable to various types of Distributed Denial of Service (DDoS) attacks. At present, almost all the research work focuses on high-rate DDoS attack against the SDN control layer. Moreover, most of the existing detection methods are effective for high-rate DDoS attack detection of the control layer, while a low-rate DDoS attack against the SDN data layer is highly concealed, and the detection accuracy against this kind of attack is low. In order to improve the detection accuracy of the low-rate DDoS attack against the SDN data layer, this paper studies the mechanism of such attacks, and then proposes a multi-feature DDoS attack detection method based on Factorization Machine (FM). The features extracted from the flow rules are used to detect low-rate DDoS attacks, and the detection of low-rate DDoS attacks based on FM machine learning algorithms is implemented. The experimental results show that the method can effectively detect the low-rate DDoS attack against the SDN data layer, and the detection accuracy reaches 95.80 percent. Because FM algorithm can achieve fine-grained detection for low-rate DDoS attack, which provides a reliable condition for defending against such attacks. Finally, this paper proposes a defense method based on dynamic deletion of flow rules, and carries out experimental simulation and analysis to prove the effectiveness of the defense method, and the success rate of forwarding normal packets reached 97.85 percent.

The Automatic Dependent Surveillance-Broadcast(ADS-B) system adopts an open communication mode, and the lack of designed-in security measures in the ADS-B system makes it vulnerable to various types of attacks (jamming, spoofing, etc.). In view of the low-bandwidth and less data bits features of the ADS-B, this paper studies the integrity and authenticity of information by signing messages, and proposes an ADS-B message authentication method based on Certificateless Short Signature(CLSS). This method uses short signature and does not require certificate management and has efficient performance. Compared with the existing approach, the computation costs of the proposed method in the signature phase is reduced by 1/2 and the signature length is reduced by 3/4. Additionally, we used the extended NS2 simulation platform to simulate 1090ES data link in different scenarios of network, the simulation result show that our solution is suitable for minimum operational performance standard of ADS-B.

In this paper, a novel image zero-watermarking scheme against rotation attacks is proposed based on nonsubsampled pyramid decomposition (NSPD) and discrete cosine transform (DCT). It utilizes the intrinsic characteristics of NSPD and DCT to extract the robust feature of an image as the original zero-watermark. To increase the security of the proposed scheme, a variable parameter chaotic mapping (VPCM) is designed for the processes of watermark encryption and robust feature extraction. Firstly, the host gray-scale image is decomposed by NSPD, and the low-frequency sub-band image is divided into non-overlapping blocks. After the blocks are transformed by DCT, the signs of the first AC coefficients from all the blocks are used to construct a binary feature image. Then an exclusive-or operation is performed between the binary feature image and the encrypted watermark image to obtain the verification zero-watermark image. Furthermore, a method against arbitrary rotation attacks is employed to improve the robustness of the scheme against geometric attacks. The experimental results demonstrate that the proposed scheme is highly robust against various image processing attacks such as filtering, JPEG compression, scaling, translation, rotation and Checkmark attacks.

Automatic dependent surveillance–broadcasting (ADS-B) is a surveillance technology strongly promoted by the International Civil Aviation Organization. It has been widely used in commercial and general aviation, to provide support for the normal operation of air traffic control (ATC) in commercial aviation. However, the openness of the ADS-B protocol makes it extremely vulnerable to cyber attacks. Previous research did not specifically consider the application scenarios of ATC in commercial air transport, and there is a problem of low attack detection rates. This article focuses on ADS-B attack detection under the background of ATC. We combine the flight plan with ADS-B information to construct an airspace flight image stream and process the image stream using a generative adversarial network–long short-term memory (GAN-LSTM) model to predict future images. Then, we identify abnormal images based on the normalized cross-correlation and mark anomalous targets. Our method can quickly locate anomalous targets in the controlled airspace. Based on real flight data, abnormal data for various malicious attacks were forged. We evaluated the detection performance of the method through a confusion matrix and several performance indices. The final experimental results showed that our detection scheme exhibited good detection performances for various attacks, with an average detection accuracy of 92.3%, a false positive rate of 11.9%, and a false negative rate of 6.2%. This approach guarantees the information security of ADS-B, thereby improving the operational security of ATC.