Early Detection of LDDoS Attacks in IoT Utilizing Locality Sensitive Incremental TSVM Method

The Mirai botnet and its variants has made Internet of Things (IoT) devices a powerful amplifying platform for Low-rate Distributed Denial-of-Service (LDDoS) attacks. In this paper, we firstly propose a new low-rate variant, which is a sophisticated crossfire low-rate DDoS attack mechanism. At the same time, we investigate and develop a novel semi-supervised Locality Sensitive Incremental Transductive Support Vector Machine (LS-ITSVM) method. The proposed method maximizes the margins of different network flows by incorporating local frequency-domain features from the autocorrelation sequence of network flow into the regularization time-domain framework of TSVM. And it saves training and detecting time by incremental training support vectors and new added samples. In experiments, we verify the proposed crossfire LDDoS is more concealed and harmful firstly. Then, the result in public dataset proves the proposed method can distinguish abnormal network flows with higher detection accuracy, faster training and response time, and prevent abnormal network flow groups with less impaction. At last, the results in private testbed prove LS-ITSVM is still available to new LDDoS variants.