A Low-rate DDoS Strategy for Unknown Bottleneck Link Characteristics

Low-rate Distributed Denial of Service (LDDoS) attacks degrade the quality of TCP links with low average traffic by exploiting vulnerabilities in the TCP/IP protocol and routing queue management mechanisms. The ideal transmission rate of the attack pulse in the most classical RTO-based LDDoS attacks (aka: Shrew attacks) is greater than or equal to the bandwidth of the target bottleneck link, and it is assumed that the attacker is able to set a suitably large transmission rate. However, the attacker does not always know the bandwidth of the target bottleneck link in real-world attack scenarios. In this paper, we propose a strategy for executing a low-rate shrew DDoS attack against a bottleneck link of unknown bandwidth and buffer size under a scenario targeting a residential network. The proposed attack strategy degrades downstream traffic from a specific service to the target network to the desired quality while keeping the attack traffic stealthy by exploratively increasing the pulse rate while estimating the attack effect by building bot nodes in the residential network.