LD²: A system for lightweight detection of denial-of-service attacks

This paper proposes a system for lightweight detection of DoS attacks, called LD². Our system detects attack activities by observing flow behaviors and matching them with graphlets for each attack type. The proposed system is lightweight because it does not analyze packet content nor packet statistics. We benchmark performance of LD², in terms of detection accuracy and complexity against Snort, a popular open-source IDS software. Our evaluations focus on six types of DoS attacks, namely SYN flood, UDP flood, ICMP flood, Smurf, port scan, and host scan. Results show that LD² can accurately identify all occurrences and all hosts associated with attack activities. Although LD² uses higher CPU cycles than Snort, it consumes much less memory than Snort.