Vedula, VasudhaLama, PaldenBoppana, Rajendra V.Trejo, Luis A.2021-09-092021-09-092021-08-30Electronics 10 (17): 2105 (2021)https://hdl.handle.net/20.500.12588/677Distributed denial of service (DDoS) attacks aim to deplete the network bandwidth and computing resources of targeted victims. Low-rate DDoS attacks exploit protocol features such as the transmission control protocol (TCP) three-way handshake mechanism for connection establishment and the TCP congestion-control induced backoffs to attack at a much lower rate and still effectively bring down the targeted network and computer systems. Most of the statistical and machine/deep learning-based detection methods proposed in the literature require keeping track of packets by flows and have high processing overheads for feature extraction. This paper presents a novel two-stage model that uses Long Short-Term Memory (LSTM) and Random Forest (RF) to detect the presence of attack flows in a group of flows. This model has a very low data processing overhead; it uses only two features and does not require keeping track of packets by flows, making it suitable for continuous monitoring of network traffic and on-the-fly detection. The paper also presents an LSTM Autoencoder to detect individual attack flows with high detection accuracy using only two features. Additionally, the paper presents an analysis of a support vector machine (SVM) model that detects attack flows in slices of network traffic collected for short durations. The low-rate attack dataset used in this study is made available to the research community through GitHub.Attribution 4.0 United Stateshttps://creativecommons.org/licenses/by/4.0/deep learning modelsdistributed denial of service attacksHTTP slow-read attacksmachine learning modelsnetwork securityTCP SYN floodsArticle2021-09-09