Table of Contents Author Guidelines Submit a Manuscript
Security and Communication Networks
Volume 2017, Article ID 3691629, 14 pages
Research Article

Low-Rate DDoS Attack Detection Using Expectation of Packet Size

School of Mathematics and Computer Science, Wuhan Polytechnic University, Wuhan 430023, China

Correspondence should be addressed to Mingchao Liao; nc.ude.uphw@oahcgniml

Received 7 May 2017; Revised 6 July 2017; Accepted 31 July 2017; Published 11 October 2017

Academic Editor: Huaizhi Li

Copyright © 2017 Lu Zhou et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.


Low-rate Distributed Denial-of-Service (low-rate DDoS) attacks are a new challenge to cyberspace, as the attackers send a large amount of attack packets similar to normal traffic, to throttle legitimate flows. In this paper, we propose a measurement—expectation of packet size—that is based on the distribution difference of the packet size to distinguish two typical low-rate DDoS attacks, the constant attack and the pulsing attack, from legitimate traffic. The experimental results, obtained using a series of real datasets with different times and different tolerance factors, are presented to demonstrate the effectiveness of the proposed measurement. In addition, extensive experiments are performed to show that the proposed measurement can detect the low-rate DDoS attacks not only in the short and long terms but also for low packet rates and high packet rates. Furthermore, the false-negative rates and the adjudication distance can be adjusted based on the detection sensitivity requirements.