DDoS: Flood vs. Shrew

Distributed Denial of Service (DDoS) attack is one of the greatest threats to connectivity, continuity, and availability of the Internet. In this paper, two typical types of DDoS attacks, high-rate (Flood) and low-rate (Shrew), are studied on their generation principles, mechanism utilizations, behaviors, signatures, and attack performances. Experiment results show that: (I) high-rate DDoS sends a large amount of traffic to destroy the victim but it is easy to be detected. (II) low-rate DDoS organizes a small quantity of traffic to degrade the service quality at the victim end and it is easy to escape from detection. Comparison of flood with shrew is helpful to detect and defend DDoS attacks efficiently.