A Study on Low-Rate DDoS Attacks in Real Networks

DDoS attacks are becoming more advanced to attack with a small traffic that is difficult to detect. In this paper, we propose two DDoS attacks that send a small traffic. One named SQL Search attack that is modified DoS attack using SQL wildcards. The other named Mass Contents Request attack that request large files. We prove experimentally that they are possible for the real homepages to DDoS attack with 10Megabytes/sec to 1Gigabytes/sec traffic. Also, we prove that proposed DDoS attacks have a small traffic and no patterns that not only it is difficult to detect of threshold-based but also it is hardly possible to detect of pattern-based through an experiment.