Identifying LDoS attack traffic based on wavelet energy spectrum and combined neural network

As a special type of denial of service (DoS) attacks, the TCP‐targeted low‐rate denial of service (LDoS) attacks have the characteristics of low average rate and strong concealment, so it is difficult to identify such attack traffic. As multifractal characteristics exist in network traffic, a new identification approach based on wavelet transform and combined neural network is proposed to classify normal network traffic and LDoS attack traffic. Wavelet energy spectrum coefficients extracted from the sampled traffic are used for multifractal analysis of traffic over different time scale. The combined neural network is designed to classify these multiscale spectrum coefficients that show different multifractal characteristics belonging to normal network traffic and LDoS attack traffic. Test results of test‐bed experiments indicate that the proposed approach can identify LDoS attack traffic accurately.