A round-trip time-based prevention technique to secure LEO satellite networks from denial-of-service attacks

This paper discusses the protection of satellite systems from denial-of-service (DoS) attacks which are a serious security threat in today's Internet. A method is proposed to detect DoS attacks in the vicinity of flooding sources and in early stages before they cripple the system. The fundamental challenge in attack detection consists in distinguishing between simple flash events and DoS attacks so as not to deprive innocent users from having legitimate access. In the proposed mechanism, this distinction is based on the fact that legitimate TCP flows obey the congestion control protocol, whereas misbehaving sources remain unresponsive. Suspicious flows are sent a test feedback and are required to decrease their sending rates. Legitimacy of such flows is decided based on their responsiveness. The scheme performance is evaluated through a set of simulations and encouraging results are obtained: short detection latency and high detection accuracy.