Similarity measurement of LDOS flows variations based on edit distance

Low-rate Denial-of-Service (LDoS) attacks have been studied for more than 10 years, but few projects were there in researching the impacts of end-to-end delay have on LDoS flows. In this paper, we propose a new metric to measure the similarity of two time series, the LDoS Measuring Model and the Duration Model to analyze differences in packet sequence pattern. Based on the methods, we reveal a neglected but important facts: End-to-end delay does have impacts on LDoS flows, but the impacts are limited for the periods and durations of LDoS flows, it affects more on the arrival of packets, making them distribute like flushes, which could cause the failure of LDoS attacks.