A Reliable Real-Time Slow DoS Detection Framework for Resource-Constrained IoT Networks

Reed, Andy; Dooley, Laurence S. and Kouadri Mostéfaoui, Soraya (2022). A Reliable Real-Time Slow DoS Detection Framework for Resource-Constrained IoT Networks. In: 2021 IEEE Global Communications Conference (GLOBECOM), 7-11 Dec 2021, Madrid, Spain, IEEE.

DOI: https://doi.org/10.1109/GLOBECOM46510.2021.9685612

Abstract

Slow DoS attacks have proven to pose a significant security threat to low-resource IoT devices and networks, because they can be launched by nodes which consume nominal bandwidth and have limited resource capability. This makes such malicious attacks easy to initiate, but difficult to mitigate. There also exists the recurrent likelihood of misclassifying legitimate nodes, which are incurring slow or poor network connectivity, as malicious activity. Existing intrusion detection systems (IDS) for detecting Slow DoS attacks often require the creation of large datasets for post event analysis. A functional disadvantage of this dataset-driven approach is the sheer volume of data required, due to the high number of network attributes and events collated, which precludes an in-line, real-time IDS detection solution for live IoT networks. This paper presents an innovative IDS detection framework for resource constrained IoT networks. Using a set of only four attributes, a two-step analysis of live IoT network events enables Slow DoS attacks, in the form of Slowloris, to be both efficiently and reliably detected in real-time. In addition, this lightweight IDS framework can accurately distinguish between malicious and genuine nodes encountering slow or intermittent network connections.

Viewing alternatives

Look up in Google Scholar

Download history

Metrics

Public Attention

Altmetrics from Altmetric

Number of Citations

Citations from Dimensions

Item Actions

Export

About

CORE (COnnecting REpositories)

Recommendations