A CRF-theory-based method for BGP-LDoS attack detection

There has been a new type of attacks, LDoS attack against BGP sessions (BGP-LDoS). It is more harmful than traditional network attacks. However, existing security solutions for inter domain routing system are mainly addressed to deal with threats which come from control plane and generally utilize abnormal inter domain routing information to launch an attack. They are of no effect to detect BGP-LDoS attack, which comes from data plane and utilizes large scale network traffic to launch an attack. This paper presents a BGP-LDoS attack detection method based on traffic classification model. Three classification features are firstly chosen by statistical analysis. Then we leverage Conditional Random Field theory to build a BGP-LDoS attack traffic classification model which has capacity of classifying unlabeled network traffic, so as to infer whether there has BGP-LDoS attack traffic. The experimental results confirm the method's ability to detect BGP-LDoS attacks.