Abstract:

Pulsing-based denial of service attack (PDoS attack) is a recently discovered attack that uses high narrow spikes to throttle TCP flows. Comparing with traditional flooding-based denial of service attacks, PDoS attacks are also effective but much more difficult to detect. In this paper, we analyze the frangibility of TCP congestion control mechanism and the rational of PDoS attack. We also review current detection schemes and discuss their disadvantages. Finally, we propose a new detection scheme basing on traffic digest, which can not only detect aggregative stream containing attack flow but also identify the attack flow.

Key words: PDoS attack, TCP-target attack, traffic digest, anomaly detection