Smart NCAP supporting low-rate DDoS detection for IEEE 21451-1-5 internet of things

With the increasing variety of Internet of Things (IoT) devices, the complexity and heterogeneity of next generation IoT have increased the difficulty of managing IoT devices. The development direction of traditional IoT networks is moving towards the IEEE-21451 standard architecture. In IEEE-21451 standard system, Network Capable Application Processor (N-CAP) is a pivotal composition of the overall network architecture while there is not a mature architecture and implementation of smart NCAP. In addition, the new IoT is facing a variety of security issues. As a new type of Distributed Denial of Service (DDoS) attack, Low-rate Distributed Denial of Service (LDDoS) attack is efficient and uneasy to find. Considering the limited resources of IoT devices, it's difficult to establish security mechanism against LDDoS attack in IoT node level. In this paper, we propose a smart NCAP supporting LDDoS detection and implement the NCAP test bed platform using the Raspberry Pi. We design the architecture of smart NCAP from perspectives of embedding SNMP module, management work and mechanism for interacting with nodes. Then we propose a method for detecting LDDoS attack traffic using a linear multiple regression model with Simple Network Management Protocol (SNMP) contents. Simulations show that the computational resources occupied by the proposed scheme are within an acceptable range.