Visible to the public Biblio

Filters: Keyword is Packet loss  [Clear All Filters]
2021-06-28
Nageswar Rao, A., Rajendra Naik, B., Nirmala Devi, L., Venkata Subbareddy, K..  2020.  Trust and Packet Loss Aware Routing (TPLAR) for Intrusion Detection in WSNs. 2020 12th International Conference on Computational Intelligence and Communication Networks (CICN). :386–391.
In this paper, a new intrusion detection mechanism is proposed based on Trust and Packet Loss Rate at Sensor Node in WSNs. To find the true malicious nodes, the proposed mechanism performs a deep analysis on the packet loss. Two independent metrics such as buffer capacity metric and residual energy metric are considered for packet loss rate evaluation. Further, the trust evaluation also considers the basic communication interactions between sensor nodes. Based on these three metrics, a new composite metric called Packet Forwarding Probability (PFP) is derived through which the malicious nodes are identified. Simulation experiments are conducted over the proposed mechanism and the performance is evaluated through False Positive Rate (FPR) and Malicious Detection Rate (MDR). The results declare that the proposed mechanism achieves a better performance compared to the conventional approaches.
2021-04-08
Shi, S., Li, J., Wu, H., Ren, Y., Zhi, J..  2020.  EFM: An Edge-Computing-Oriented Forwarding Mechanism for Information-Centric Networks. 2020 3rd International Conference on Hot Information-Centric Networking (HotICN). :154–159.
Information-Centric Networking (ICN) has attracted much attention as a promising future network design, which presents a paradigm shift from host-centric to content-centric. However, in edge computing scenarios, there is still no specific ICN forwarding mechanism to improve transmission performance. In this paper, we propose an edge-oriented forwarding mechanism (EFM) for edge computing scenarios. The rationale is to enable edge nodes smarter, such as acting as agents for both consumers and providers to improve content retrieval and distribution. On the one hand, EFM can assist consumers: the edge router can be used either as a fast content repository to satisfy consumers’ requests or as a smart delegate of consumers to request content from upstream nodes. On the other hand, EFM can assist providers: EFM leverages the optimized in-network recovery/retransmission to detect packet loss or even accelerate the content distribution. The goal of our research is to improve the performance of edge networks. Simulation results based on ndnSIM indicate that EFM can enable efficient content retrieval and distribution, friendly to both consumers and providers.
2021-03-09
Fiade, A., Triadi, A. Yudha, Sulhi, A., Masruroh, S. Ummi, Handayani, V., Suseno, H. Bayu.  2020.  Performance Analysis of Black Hole Attack and Flooding Attack AODV Routing Protocol on VANET (Vehicular Ad-Hoc Network). 2020 8th International Conference on Cyber and IT Service Management (CITSM). :1–5.
Wireless technology is widely used today and is growing rapidly. One of the wireless technologies is VANET where the network can communicate with vehicles (V2V) which can prevent accidents on the road. Energy is also a problem in VANET so it needs to be used efficiently. The presence of malicious nodes or nodes can eliminate and disrupt the process of data communication. The routing protocol used in this study is AODV. The purpose of this study is to analyze the comparison of blackhole attack and flooding attack against energy-efficient AODV on VANET. This research uses simulation methods and several supporting programs such as OpenStreetMap, SUMO, NS2, NAM, and AWK to test the AODV routing protocol. Quality of service (QOS) parameters used in this study are throughput, packet loss, and end to end delay. Energy parameters are also used to examine the energy efficiency used. This study uses the number of variations of nodes consisting of 20 nodes, 40 nodes, 60 nodes, and different network conditions, namely normal network conditions, network conditions with black hole attacks, and network conditions with flooding attacks. The results obtained can be concluded that the highest value of throughput when network conditions are normal, the greatest value of packet loss when there is a black hole attack, the highest end to end delay value and the largest remaining energy when there is a flooding attack.
2021-02-03
Gao, L., Sun, J., Li, J..  2020.  Security of Networked Control Systems with Incomplete Information Based on Game Theory. 2020 39th Chinese Control Conference (CCC). :6701—6706.

The security problem of networked control systems (NCSs) suffering denial of service(DoS) attacks with incomplete information is investigated in this paper. Data transmission among different components in NCSs may be blocked due to DoS attacks. We use the concept of security level to describe the degree of security of different components in an NCS. Intrusion detection system (IDS) is used to monitor the invalid data generated by DoS attacks. At each time slot, the defender considers which component to monitor while the attacker considers which place for invasion. A one-shot game between attacker and defender is built and both the complete information case and the incomplete information case are considered. Furthermore, a repeated game model with updating beliefs is also established based on the Bayes' rule. Finally, a numerical example is provided to illustrate the effectiveness of the proposed method.

2020-12-21
Preda, M., Patriciu, V..  2020.  Simulating RPL Attacks in 6lowpan for Detection Purposes. 2020 13th International Conference on Communications (COMM). :239–245.
The Internet of Things (IoT) integrates the Internet and electronic devices belonging to different domains, such as smart home automation, industrial processes, military applications, health, and environmental monitoring. Usually, IoT devices have limited resources and Low Power and Lossy Networks (LLNs) are being used to interconnect such devices. Routing Protocol for Low-Power and Lossy Networks (RPL) is one of the preferred routing protocols for this type of network, since it was specially developed for LLNs, also known as IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN). In this paper the most well-known routing attacks against 6LoWPAN networks were studied and implemented through simulation, conducting a behavioral analysis of network components (resources, topology, and data traffic) under attack condition. In order to achieve a better understanding on how attacks in 6LoWPAN work, we first conducted a study on 6LoWPAN networks and RPL protocol functioning. Furthermore, we also studied a series of well-known routing attacks against this type of Wireless Sensor Networks and these attacks were then simulated using Cooja simulator provided by Contiki operating system. The results obtained after the simulations are discussed along with other previous researches. This analysis may be of real interest when it comes to identify indicators of compromise for each type of attack and appropriate countermeasures for prevention and detection of these attacks.
2020-12-02
Yu, C., Quan, W., Cheng, N., Chen, S., Zhang, H..  2019.  Coupled or Uncoupled? Multi-path TCP Congestion Control for High-Speed Railway Networks 2019 IEEE/CIC International Conference on Communications in China (ICCC). :612—617.

With the development of modern High-Speed Railway (HSR) and mobile communication systems, network operators have a strong demand to provide high-quality on-board Internet services for HSR passengers. Multi-path TCP (MPTCP) provides a potential solution to aggregate available network bandwidth, greatly overcoming throughout degradation and severe jitter using single transmission path during the high-speed train moving. However, the choose of MPTCP algorithms, i.e., Coupled or Uncoupled, has a great impact on the performance. In this paper, we investigate this interesting issue in the practical datasets along multiple HSR lines. Particularly, we collect the first-hand network datasets and analyze the characteristics and category of traffic flows. Based on this statistics, we measure and analyze the transmission performance for both mice flows and elephant ones with different MPTCP congestion control algorithms in HSR scenarios. The simulation results show that, by comparing with the coupled MPTCP algorithms, i.e., Fully Coupled and LIA, the uncoupled EWTCP algorithm provides more stable throughput and balances congestion window distribution, more suitable for the HSR scenario for elephant flows. This work provides significant reference for the development of on-board devices in HSR network systems.

Islam, S., Welzl, M., Hiorth, K., Hayes, D., Armitage, G., Gjessing, S..  2018.  ctrlTCP: Reducing latency through coupled, heterogeneous multi-flow TCP congestion control. IEEE INFOCOM 2018 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). :214—219.

We present ctrlTCP, a method to combine the congestion controls of multiple TCP connections. In contrast to the previous methods such as the Congestion Manager, ctrlTCP can couple all TCP flows that leave one sender, traverse a common bottleneck (e.g., a home user's thin uplink) and arrive at different destinations. Using ns-2 simulations and an implementation in the FreeBSD kernel, we show that our mechanism reduces queuing delay, packet loss, and short flow completion times while enabling precise allocation of the share of the available bandwidth between the connections according to the needs of the applications.

Kaur, M., Malik, A..  2018.  An Efficient and Reliable Routing Protocol Using Bio-Inspired Techniques for Congestion Control in WSN. 2018 4th International Conference on Computing Sciences (ICCS). :15—22.

In wireless sensor networks (WSNs), congestion control is a very essential region of concern. When the packets that are coming get increased than the actual capacity of network or nodes results into congestion in the network. Congestion in network can cause reduction in throughput, increase in network delay, and increase in packet loss and sensor energy waste. For that reason, new complex methods are mandatory to tackle with congestion. So it is necessary to become aware of congestion and manage the congested resources in wireless sensor networks for enhancing the network performance. Diverse methodologies for congestion recognition and prevention have been presented in the previous couple of years. To handle some of the problems, this paper exhibits a new technique for controlling the congestion. An efficient and reliable routing protocol (ERRP) based on bio inspired algorithms is introduced in this paper for solving congestion problem. In the proposed work, a way is calculated to send the packets on the new pathway. The proposed work has used three approaches for finding the path which results into a congestion free path. Our analysis and simulation results shows that our approach provides better performance as compared to previous approaches in terms of throughput, packet loss, delay etc.

2020-12-01
Hendrawan, H., Sukarno, P., Nugroho, M. A..  2019.  Quality of Service (QoS) Comparison Analysis of Snort IDS and Bro IDS Application in Software Define Network (SDN) Architecture. 2019 7th International Conference on Information and Communication Technology (ICoICT). :1—7.

Intrusion Detection system (IDS) was an application which was aimed to monitor network activity or system and it could find if there was a dangerous operation. Implementation of IDS on Software Define Network architecture (SDN) has drawbacks. IDS on SDN architecture might decreasing network Quality of Service (QoS). So the network could not provide services to the existing network traffic. Throughput, delay and packet loss were important parameters of QoS measurement. Snort IDS and bro IDS were tools in the application of IDS on the network. Both had differences, one of which was found in the detection method. Snort IDS used a signature based detection method while bro IDS used an anomaly based detection method. The difference between them had effects in handling the network traffic through it. In this research, we compared both tools. This comparison are done with testing parameters such as throughput, delay, packet loss, CPU usage, and memory usage. From this test, it was found that bro outperform snort IDS for throughput, delay , and packet loss parameters. However, CPU usage and memory usage on bro requires higher resource than snort.

2020-10-29
Mintu, Singh, Gursharan, Malhi, Simarjit Singh, Mahajan, Makul, Batra, Salil, Bath, Ranbir Singh.  2019.  Anatomization of Detection and Performance Measures Techniques for Flooding Attacks using Routing Protocols in MANETs. 2019 International Conference on Automation, Computational and Technology Management (ICACTM). :160—167.
Mobile ad-hoc network (MANETS) is generally appropriate in different territories like military tactical network, educational, home and entertainment and emergency operations etc. The MANETSs are simply the disintegration and designing kind of system in this portable hubs coming up and out the system whenever. Because of decentralized creation of the network, security, routing and Standard of service are the three noteworthy issues. MANETSs are helpless against security attack in light of the decentralized validation. The mobile hubs can enter or out the system and at some point malicious hubs enter the system, which are capable to trigger different dynamic and inactive attack. The flooding attack is the dynamic sort of attack in which malicious hubs transfers flooding packets on the medium. Because of this, medium gets over-burden and packets drop may happen inside the system. This decreases the throughput and increased packet loss. In this paper we illustrated different techniques and proposed various methods responsible for flooding attack. Our commitment in this paper is that we have investigated various flooding attacks in MANETs, their detection techniques with performance measure parameters.
2020-10-26
Changazi, Sabir Ali, Shafi, Imran, Saleh, Khaled, Islam, M Hasan, Hussainn, Syed Muzammil, Ali, Atif.  2019.  Performance Enhancement of Snort IDS through Kernel Modification. 2019 8th International Conference on Information and Communication Technologies (ICICT). :155–161.
Performance and improved packet handling capacity against high traffic load are important requirements for an effective intrusion detection system (IDS). Snort is one of the most popular open-source intrusion detection system which runs on Linux. This research article discusses ways of enhancing the performance of Snort by modifying Linux key parameters related to NAPI packet reception mechanism within the Linux kernel networking subsystem. Our enhancement overcomes the current limitations related to NAPI throughput. We experimentally demonstrate that current default budget B value of 300 does not yield the best performance of Snort throughput. We show that a small budget value of 14 gives the best Snort performance in terms of packet loss both at Kernel subsystem and at the application level. Furthermore, we compare our results to those reported in the literature, and we show that our enhancement through tuning certain parameters yield superior performance.
2020-06-15
Bouras, Christos, Kanakis, Nikolaos.  2018.  Evolving AL-FEC Application Towards 5G NGMN. 2018 9th IFIP International Conference on New Technologies, Mobility and Security (NTMS). :1–5.
The fifth generation of mobile technology (5G) is positioned to address the demands and business contexts of 2020 and beyond. Therefore, in 5G, there is a need to push the envelope of performance to provide, where needed, for example, much greater throughput, much lower latency, ultra-high reliability, much higher connectivity density, and higher mobility range. A crucial point in the effective provisioning of 5G Next Generation Mobile Networks (NGMN) lies in the efficient error control and in more details in the utilization of Forward Error Correction (FEC) codes on the application layer. FEC is a method for error control of data transmission adopted in several mobile multicast standards. FEC is a feedback free error recovery method where the sender introduces redundant data in advance with the source data enabling the recipient to recover from different arbitrary packet losses. Recently, the adoption of FEC error control method has been boosted by the introduction of powerful Application Layer FEC (AL-FEC) codes. Furthermore, several works have emerged aiming to address the efficient application of AL-FEC protection introducing deterministic or randomized online algorithms. In this work we propose a novel AL-FEC scheme based on online algorithms forced by the well stated AL-FEC policy online problem. We present an algorithm which exploits feedback capabilities of the mobile users regarding the outcome of a transmission, and adapts the introduced protection respectively. Moreover, we provide an extensive analysis of the proposed AL-FEC algorithm accompanied by a performance evaluation against common error protection schemes.
2020-03-23
Daoud, Luka, Rafla, Nader.  2019.  Analysis of Black Hole Router Attack in Network-on-Chip. 2019 IEEE 62nd International Midwest Symposium on Circuits and Systems (MWSCAS). :69–72.

Network-on-Chip (NoC) is the communication platform of the data among the processing cores in Multiprocessors System-on-Chip (MPSoC). NoC has become a target to security attacks and by outsourcing design, it can be infected with a malicious Hardware Trojan (HT) to degrades the system performance or leaves a back door for sensitive information leaking. In this paper, we proposed a HT model that applies a denial of service attack by deliberately discarding the data packets that are passing through the infected node creating a black hole in the NoC. It is known as Black Hole Router (BHR) attack. We studied the effect of the BHR attack on the NoC. The power and area overhead of the BHR are analyzed. We studied the effect of the locations of BHRs and their distribution in the network as well. The malicious nodes has very small area and power overhead, 1.98% and 0.74% respectively, with a very strong violent attack.

2020-02-17
Hao, Lina, Ng, Bryan.  2019.  Self-Healing Solutions for Wi-Fi Networks to Provide Seamless Handover. 2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM). :639–642.
The dynamic nature of the wireless channel poses a challenge to services requiring seamless and uniform network quality of service (QoS). Self-healing, a promising approach under the self-organizing networks (SON) paradigm, and has been shown to deal with unexpected network faults in cellular networks. In this paper, we use simple machine learning (ML) algorithms inspired by SON developments in cellular networks. Evaluation results show that the proposed approach identifies the faulty APs. Our proposed approach improves throughput by 63.6% and reduces packet loss rate by 16.6% compared with standard 802.11.
2019-01-21
Memedi, A., Sommer, C., Dressler, F..  2018.  On the need for coordinated access control for vehicular visible light communication. 2018 14th Annual Conference on Wireless On-demand Network Systems and Services (WONS). :121–124.
We argue on the need for a dedicated medium access control (MAC) for Vehicular VLC (V-VLC). The huge unlicensed spectrum that can support high throughput applications and the intrinsic security due to the LOS requirement make visible light a viable candidate for use in vehicular communications. In some first research work, the directionality of V-VLC has been considered and an initial conclusion was that the small collision domain leads to negligible interference and, thus, dedicated mechanisms for medium access are unnecessary. However, in a more realistic simulation setup using the Luxembourg mobility model, we are able to show that, in certain geographical areas, the number of transmitters seen at a single receiver can easily grow up to 30. Considering packet transmissions, the interference-induced packet loss can be substantial, reaching up to 13 % during rush hours. We thus make the case that this packet loss should be mitigated with a dedicated MAC for coordinated access control in V-VLC.
2018-06-11
Zhang, X., Li, R., Zhao, H..  2017.  Neighbor-aware based forwarding strategy in NDN-MANET. 2017 11th IEEE International Conference on Anti-counterfeiting, Security, and Identification (ASID). :125–129.

Named Data Networking (NDN) is a future Internet architecture, NDN forwarding strategy is a hot research topic in MANET. At present, there are two categories of forwarding strategies in NDN. One is the blind forwarding(BF), the other is the aware forwarding(AF). Data packet return by the way that one came forwarding strategy(DRF) as one of the BF strategy may fail for the interruptions of the path that are caused by the mobility of nodes. Consumer need to wait until the interest packet times out to request the data packet again. To solve the insufficient of DRF, in this paper a Forwarding Strategy, called FN based on Neighbor-aware is proposed for NDN MANET. The node maintains the neighbor information and the request information of neighbor nodes. In the phase of data packet response, in order to improve request satisfaction rate, node specifies the next hop node; Meanwhile, in order to reduce packet loss rate, node assists the last hop node to forward packet to the specific node. The simulation results show that compared with DRF and greedy forwarding(GF) strategy, FN can improve request satisfaction rate when node density is high.

2018-04-11
Wu, X., Xiao, J., Shao, J..  2017.  Trust-Based Protocol for Securing Routing in Opportunistic Networks. 2017 13th IEEE Conference on Automation Science and Engineering (CASE). :434–439.

It is hard to set up an end-to-end connection between source and destination in Opportunistic Networks, due to dynamic network topology and the lack of infrastructure. Instead, the store-carry-forward mechanism is used to achieve communication. Namely, communication in Opportunistic Networks relies on the cooperation among nodes. Correspondingly, Opportunistic Networks have some issues like long delays, packet loss and so on, which lead to many challenges in Opportunistic Networks. However, malicious nodes do not follow the routing rules, or refuse to cooperate with benign nodes. Some misbehaviors like black-hole attack, gray-hole attack may arbitrarily bloat their delivery competency to intercept and drop data. Selfishness in Opportunistic Networks will also drop some data from other nodes. These misbehaviors will seriously affect network performance like the delivery success ratio. In this paper, we design a Trust-based Routing Protocol (TRP), combined with various utility algorithms, to more comprehensively evaluate the competency of a candidate node and effectively reduce negative effects by malicious nodes. In simulation, we compare TRP with other protocols, and shows that our protocol is effective for misbehaviors.

Nandhini, M., Priya, P..  2017.  A Hybrid Routing Algorithm for Secure Environmental Monitoring System in WSN. 2017 International Conference on Communication and Signal Processing (ICCSP). :1061–1065.

Wireless sensor networks are the most prominent set of recently made sensor nodes. They play a numerous role in many applications like environmental monitoring, agriculture, Structural and industrial monitoring, defense applications. In WSN routing is one of the absolutely requisite techniques. It enhance the network lifetime. This can be gives additional priority and system security by using bio inspired algorithm. The combination of bio inspired algorithms and routing algorithms create a way to easy data transmission and improves network lifetime. We present a new metaheuristic hybrid algorithm namely firefly algorithm with Localizability aided localization routing protocol for encircle monitoring in wireless area. This algorithm entirely covers the wireless sensor area by localization process and clumping the sensor nodes with the use of LAL (Localizability Aided Localization) users can minimize the time latency, packet drop and packet loss compared to traditional methods.

2018-03-05
Fan, Z., Wu, H., Xu, J., Tang, Y..  2017.  An Optimization Algorithm for Spatial Information Network Self-Healing Based on Software Defined Network. 2017 12th International Conference on Computer Science and Education (ICCSE). :369–374.

Spatial information network is an important part of the integrated space-terrestrial information network, its bearer services are becoming increasingly complex, and real-time requirements are also rising. Due to the structural vulnerability of the spatial information network and the dynamics of the network, this poses a serious challenge to how to ensure reliable and stable data transmission. The structural vulnerability of the spatial information network and the dynamics of the network brings a serious challenge of ensuring reliable and stable data transmission. Software Defined Networking (SDN), as a new network architecture, not only can quickly adapt to new business, but also make network reconfiguration more intelligent. In this paper, SDN is used to design the spatial information network architecture. An optimization algorithm for network self-healing based on SDN is proposed to solve the failure of switching node. With the guarantee of Quality of Service (QoS) requirement, the link is updated with the least link to realize the fast network reconfiguration and recovery. The simulation results show that the algorithm proposed in this paper can effectively reduce the delay caused by fault recovery.

2017-12-20
Meng, X., Zhao, Z., Li, R., Zhang, H..  2017.  An intelligent honeynet architecture based on software defined security. 2017 9th International Conference on Wireless Communications and Signal Processing (WCSP). :1–6.
Honeynet is deployed to trap attackers and learn their behavior patterns and motivations. Conventional honeynet is implemented by dedicated hardware and software. It suffers from inflexibility, high CAPEX and OPEX. There have been several virtualized honeynet architectures to solve those problems. But they lack a standard operating environment and common architecture for dynamic scheduling and adaptive resource allocation. Software Defined Security (SDS) framework has a centralized control mechanism and intelligent decision making ability for different security functions. In this paper, we present a new intelligent honeynet architecture based on SDS framework. It implements security functions over Network Function Virtualization Infrastructure (NFVI). Under uniform and intelligent control, security functional modules can be dynamically deployed and collaborated to complete different tasks. It migrates resources according to the workloads of each honeypot and power off unused modules. Simulation results show that intelligent honeynet has a better performance in conserving resources and reducing energy consumption. The new architecture can fit the needs of future honeynet development and deployment.
2017-12-12
Byrenheid, M., Rossberg, M., Schaefer, G., Dorn, R..  2017.  Covert-channel-resistant congestion control for traffic normalization in uncontrolled networks. 2017 IEEE International Conference on Communications (ICC). :1–7.

Traffic normalization, i.e. enforcing a constant stream of fixed-length packets, is a well-known measure to completely prevent attacks based on traffic analysis. In simple configurations, the enforced traffic rate can be statically configured by a human operator, but in large virtual private networks (VPNs) the traffic pattern of many connections may need to be adjusted whenever the overlay topology or the transport capacity of the underlying infrastructure changes. We propose a rate-based congestion control mechanism for automatic adjustment of traffic patterns that does not leak any information about the actual communication. Overly strong rate throttling in response to packet loss is avoided, as the control mechanism does not change the sending rate immediately when a packet loss was detected. Instead, an estimate of the current packet loss rate is obtained and the sending rate is adjusted proportionally. We evaluate our control scheme based on a measurement study in a local network testbed. The results indicate that the proposed approach avoids network congestion, enables protected TCP flows to achieve an increased goodput, and yet ensures appropriate traffic flow confidentiality.

2015-05-06
Kyoungwoo Heo.  2014.  An Accumulated Loss Recovery Algorithm on Overlay Multicast System Using Fountain Codes. Information Science and Applications (ICISA), 2014 International Conference on. :1-3.

In this paper, we propose an accumulated loss recovery algorithm on overlay multicast system using Fountain codes. Fountain code successfully decodes the packet loss, but it is weak in accumulated losses on multicast tree. The proposed algorithm overcomes an accumulated loss and significantly reduces delay on overlay multicast tree.
 

Junwei Wang, Haifeng Wang.  2014.  Trust-based QoS routing algorithm for Wireless Sensor Networks. Control and Decision Conference (2014 CCDC), The 26th Chinese. :2492-2495.

With the rapid development of Wireless Sensor Networks (WSNs), besides the energy efficient, Quality of Service (QoS) supported and the validity of packet transmission should be considered under some circumstances. In this paper, according to summing up LEACH protocol's advantages and defects, combining with trust evaluation mechanism, energy and QoS control, a trust-based QoS routing algorithm is put forward. Firstly, energy control and coverage scale are adopted to keep load balance in the phase of cluster head selection. Secondly, trust evaluation mechanism is designed to increase the credibility of the network in the stage of node clusting. Finally, in the period of information transmission, verification and ACK mechanism also put to guarantee validity of data transmission. In this paper, it proposes the improved protocol. The improved protocol can not only prolong nodes' life expectancy, but also increase the credibility of information transmission and reduce the packet loss. Compared to typical routing algorithms in sensor networks, this new algorithm has better performance.

2015-04-30
Jingtang Luo, Xiaolong Yang, Jin Wang, Jie Xu, Jian Sun, Keping Long.  2014.  On a Mathematical Model for Low-Rate Shrew DDoS. Information Forensics and Security, IEEE Transactions on. 9:1069-1083.

The shrew distributed denial of service (DDoS) attack is very detrimental for many applications, since it can throttle TCP flows to a small fraction of their ideal rate at very low attack cost. Earlier works mainly focused on empirical studies of defending against the shrew DDoS, and very few of them provided analytic results about the attack itself. In this paper, we propose a mathematical model for estimating attack effect of this stealthy type of DDoS. By originally capturing the adjustment behaviors of victim TCPs congestion window, our model can comprehensively evaluate the combined impact of attack pattern (i.e., how the attack is configured) and network environment on attack effect (the existing models failed to consider the impact of network environment). Henceforth, our model has higher accuracy over a wider range of network environments. The relative error of our model remains around 10% for most attack patterns and network environments, whereas the relative error of the benchmark model in previous works has a mean value of 69.57%, and it could be more than 180% in some cases. More importantly, our model reveals some novel properties of the shrew attack from the interaction between attack pattern and network environment, such as the minimum cost formula to launch a successful attack, and the maximum effect formula of a shrew attack. With them, we are able to find out how to adaptively tune the attack parameters (e.g., the DoS burst length) to improve its attack effect in a given network environment, and how to reconfigure the network resource (e.g., the bottleneck buffer size) to mitigate the shrew DDoS with a given attack pattern. Finally, based on our theoretical results, we put forward a simple strategy to defend the shrew attack. The simulation results indicate that this strategy can remarkably increase TCP throughput by nearly half of the bottleneck bandwidth (and can be higher) for general attack patterns.