Unveiling the Stealthy Threat: Low-Rate Denial of Service (LDoS) Attacks (2024)

2.1 Traditional DoS attacks

Denial-of-Service (DoS) attacks, a long-standing threat in the cybersecurity landscape, operate according to the principle of overwhelming a target system with a huge influx of traffic. This flood of data, which often comes from multiple compromised devices (forming a botnet), is intended to exploit the means of the purpose, which makes it unable to respond to legitimate requests [4].

Imagine a popular e-commerce website suddenly flooded with millions of access requests during a major sales event. The server, unable to process the large volume, crashes, making the website inaccessible to real customers. This scenario illustrates the disruptive force of a DoS attack. The impact is immediate and clear, often resulting in complete service interruption and significant financial losses.

Key characteristics of traditional DoS attacks include:

• High volume of traffic

• Continuous and sustained attack pattern

• Easily detectable due to sudden, massive spikes in network activity

• Often requires substantial resources (e.g., large botnets) to execute effectively

2.2 LDoS attacks: A stealthier approach

However, LDoS attacks have a fundamentally different approach. Instead of brute force, they use a stealthier strategy aimed at the mechanisms designed to ensure a smooth and efficient data flow in the TCP protocol. Instead of a continuous torrent of traffic, LDoS attacks utilize short, high-intensity outbursts of traffic carefully timed to exploit vulnerabilities in TCP’s adaptive flow management mechanisms.

These bursts trigger the slow start phase in TCP’s congestion control, effectively throttling the target system’s throughput. The effectiveness of this approach lies in its subtlety—the attack traffic often resembles legitimate network congestion [1, 5], making it extremely difficult to detect and mitigate.

Key features of LDoS attacks include:

• Low overall traffic volume

• Intermittent, precisely timed traffic bursts

• Exploitation of TCP’s congestion control mechanisms

• Gradual degradation of service quality rather than immediate outage

• Difficult to distinguish from normal network fluctuations

As detection and mitigation techniques for traditional DoS attacks have improved, attackers have shifted their focus to these subtler, low-rate attacks that mimic legitimate user traffic [3]. This evolution in attack strategy highlights the ongoing cat-and-mouse game between cybersecurity professionals and malicious actors.

Figure 1 below illustrates the time model of a general LDoS attack, showcasing the key parameters: R (burst rate), L (burst length), and T (total attack period).

Understanding the distinctions between DoS and LDoS attacks is crucial for developing effective defense strategies. While traditional DoS mitigation techniques focus on handling high volumes of traffic, defending against LDoS attacks requires a more nuanced approach that can detect and respond to subtle manipulations of network protocols.

The key differences between DoS and LDoS attacks can be summarized in Table 1 as follows:

While a traditional DoS attack is akin to unleashing a tidal wave of traffic to overwhelm the target, an LDoS attack operates with the precision of a skilled sniper, carefully timing its shots to exploit weaknesses in network protocols [5].

The evolution from high-volume, easily detectable DoS attacks to stealthy, low-rate LDoS attacks highlights the constant adaptation of cyber threats. As security measures improve to counter known attack vectors, malicious actors refine their techniques, seeking new vulnerabilities to exploit. The rise of LDoS emphasizes the need for a deeper understanding of network protocols and the development of more sophisticated detection and mitigation strategies.

3.1 TCP’s congestion control comprises two main phases: Slow start and congestion avoidance

3.2 Retransmission timeouts (RTO)

To ensure reliable data delivery, TCP employs a retransmission mechanism based on acknowledgments (ACKs) from the receiver. If an ACK is not received within a specific timeframe (the RTO), the sender assumes packet loss and retransmits the data. The RTO is dynamically adjusted based on observed network conditions, balancing timely retransmissions with network stability.

This adaptive RTO mechanism ensures that TCP can respond appropriately to varying network conditions [11], but it also introduces a vulnerability that LDoS attacks can exploit.

LDoS attacks manipulate TCP’s congestion control algorithms by injecting carefully timed, short-lived traffic bursts. These bursts create a false perception of network congestion, triggering TCP’s defensive mechanisms unnecessarily.

The key vulnerabilities include:

• Slow start manipulation: By causing packet loss during the Slow Start phase, attackers can force TCP to reduce its sending rate dramatically.

• RTO exploitation: Carefully timed attack bursts can cause RTT spikes, leading to increased RTOs and unnecessary retransmissions.

• Congestion window reduction: Induced packet losses cause TCP to reduce its congestion window, limiting throughput even when the network is not genuinely congested.

3.3 Analogy: The café conversation: Understanding LDoS attacks

Imagine Alice and Bob having a discussion at a café. As they converse, an unidentified person at a nearby table periodically interjects with brief comments or sudden sound, then quickly returns to their own activities. These interruptions are precisely timed and short-lived, making it challenging to pinpoint their source.

Alice and Bob pause their conversation each time to address these interruptions. They repeat themselves, wait for the noise to subside, or struggle to recall their last point. However, the interruptions are so well-timed and intermittent that they cannot identify the source.

In this analogy, the interfering person is like the LDoS attacker, and Alice and Bob’s reactions are like TCP’s congestion control algorithms. Their conversation never flows smoothly because they are always reacting to the fake interruptions, but it is challenging to pinpoint who is causing the disruptions!

Consequently, as we have seen, while TCP’s adaptive flow management mechanisms are crucial for maintaining network stability and efficiency, they also introduce vulnerabilities that can be exploited by sophisticated attacks [10]. Ongoing research in this area focuses on developing more robust congestion control algorithms and improved detection methods for LDoS attacks, aiming to enhance TCP’s resilience in the face of evolving network threats.

While TCP’s adaptive flow management mechanisms are crucial for maintaining network stability and efficiency, they also introduce vulnerabilities that can be exploited by sophisticated LDoS attacks [12].

6.1 Frequency domain analysis (Spectral signatures)

Frequency domain analysis leveraged the power of Fourier transforms to identify periodic patterns in network traffic, which could indicate the presence of traditional LDoS attacks [14]. By analyzing the frequency spectrum of network traffic, this method could potentially detect recurring bursts of attack traffic.

6.2 Machine learning (ML) and deep learning (DL) (Intelligent detection)

Machine learning (ML) and deep learning (DL) offered a significant leap forward in LDoS detection. These techniques leverage algorithms that can learn from data to identify complex patterns and anomalies in network traffic.

6.3 SDN-specific defenses (A new frontier)

Software-Defined Networking (SDN) emerged as a revolutionary approach to network management, offering a centralized control plane for managing network resources and security policies. SDN’s centralized architecture and global network visibility provide significant advantages for detecting and mitigating LDoS attacks [16].

• Centralized visibility: SDN’s centralized controller provides a comprehensive view of network traffic across the entire network, enabling it to detect and analyze LDoS attacks more effectively. The centralized nature of SDN allows for real-time monitoring of traffic patterns and the identification of anomalies that may be missed by traditional distributed network management systems.

• Adaptive security policies: SDN enables the implementation of adaptive security policies that can respond to changing network conditions and detect LDoS attacks. By leveraging SDN’s flexibility, security policies can be automatically modified to counter emerging LDoS threats; for example, it is possible to open or change the port that is orienting the traffic at any time, enhancing the resilience of the network.

The evolution of LDoS attacks demands a continuous adaptation of detection strategies. While traditional methods have proven useful, the emergence of non-periodic attacks and the complexity of modern network environments necessitate the adoption of more sophisticated techniques. SDN, with its centralized control and dynamic capabilities, offers a promising platform for combating LDoS attacks effectively. By leveraging machine learning, advanced analytics, and adaptive security policies, SDN can provide a robust and resilient defense against this stealthy threat, safeguarding the integrity and availability of critical network infrastructure, and research in this field continues to evolve.