Detection of LDDoS attacks based on TCP connection parameters

Michael Siracusano, Stavros Shiaeles, Bogdan Ghita

Research output: Chapter in Book/Report/Conference proceedingConference contribution

91 Downloads (Pure)


Low-rate application layer distributed denial of service (LDDoS) attacks are both powerful and stealthy. They force vulnerable webservers to open all available connections to the adversary, denying resources to real users. Mitigation advice focuses on solutions that potentially degrade quality of service for legitimate connections. Furthermore, without accurate detection mechanisms, distributed attacks can bypass these defences. A methodology for detection of LDDoS attacks, based on characteristics of malicious TCP flows, is proposed within this paper. Research will be conducted using combinations of two datasets: one generated from a simulated network, the other from the publically available CIC DoS dataset. Both contain the attacks slowread, slowheaders and slowbody, alongside legitimate web browsing. TCP flow features are extracted from all connections. Experimentation was carried out using six supervised AI algorithms to categorise attack from legitimate flows. Decision trees and kNN accurately classified up to 99.99% of flows, with exceptionally low false positive and false negative rates, demonstrating the potential of AI in LDDoS detection.

Original languageEnglish
Title of host publication2018 Global Information Infrastructure and Networking Symposium, GIIS 2018
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)978-1-5386-7272-3
ISBN (Print)978-1-5386-7273-0
Publication statusPublished - 7 Feb 2019
Event2018 Global Information Infrastructure and Networking Symposium - Thessaloniki, Greece
Duration: 23 Oct 201825 Oct 2018

Publication series

NameIEEE GIIS Proceedings Series
ISSN (Print)2379-3783
ISSN (Electronic)2150-329X


Conference2018 Global Information Infrastructure and Networking Symposium
Abbreviated titleGIIS 2018


  • Artificial Intelligence
  • computer Security
  • cyber Security
  • deep Learning
  • distributed Denial of Service
  • doS
  • lDDoS
  • lDoS
  • low rate attack
  • machine Learning
  • network Defence
  • roQ


Dive into the research topics of 'Detection of LDDoS attacks based on TCP connection parameters'. Together they form a unique fingerprint.

Cite this