HawkEye: An end-host method to detect the Low-rate Denial-of-Service attack of cross-traffic over bottleneck links

Abstract

The adaptive mechanisms of the Transmission Control Protocol (TCP) address network congestion and other unpredictable network conditions. They ensure the reliability of data transmission and the stability of the network. Unfortunately, the vulnerabilities in these adaptive mechanisms are targeted explicitly by low-rate denial-of-service (LDoS) attacks, which severely degrade network service quality. Only by modifying these protocols and addressing their vulnerabilities can one entirely prevent LDoS attacks. Although various improved TCP algorithms exist, they often fail to identify LDoS attacks accurately and, in some cases, may even reduce TCP performance. Furthermore, traditional LDoS attack detection methods rely on intermediate devices, which do not meet TCP’s end-to-end performance optimization needs. We introduce HawkEye, which moves the detection mechanism to the end hosts to address this issue. HawkEye uses an improved genetic algorithm to fine-tune the parameters of the LightGBM on the sending host, integrating multiple network traffic features to detect LDoS attacks. Experimental results show that our proposed method achieves the high accuracy, high true positive rate, and low false positive rate, successfully addressing the limitations of end-host detection of LDoS attacks and providing an innovative and effective solution for enhancing LDoS attack detection.