Multi-scale Low-Rate DDoS Attack Detection Using the Generalized Total Variation Metric

We propose a mechanism to detect multi-scale low-rate DDoS attacks which uses a generalized total variation metric. The proposed metric is highly sensitive towards detecting different variations in the network traffic and evoke more distance between legitimate and attack traffic as compared to the other detection mechanisms. Most low-rate attackers invade the security system by scale-in-and-out of periodic packet burst towards the bottleneck router which severely degrades the Quality of Service (QoS) of TCP applications. Our proposed mechanism can effectively identify attack traffic of this natures, despite its similarity to legitimate traffic, based on the spacing value of our metric. We evaluated our mechanism using datasets from CAIDA DDoS, MIT Lincoln Lab, and real-time testbed traffic. Our results demonstrate that our mechanism exhibits good accuracy and scalability in the detection of multi-scale low-rate DDoS attacks.