A slow-paced attack, such as slow worm or bot, can remain undetectable indefinitely by slowing down the pace of its movement. Detecting slow attacks based on traditional anomaly detection techniques may yield high false alarm rates. Since attacks are usually controlled by pre-programmed computer codes, their behaviors have regularity. In this paper, we track outbound connections of hosts by using a time series. Although the correlation among slow attacks' connections is temporally weak; the regularity of these connections remains preserved in the time series. Accordingly, we focus on time series spectrum analysis, and propose a detection method to identify peculiar spectral patterns which can represent the occurrence of a recurring and persistent activity in the time domain. We use both synthesized traffic and real-world traffic to evaluate our method. The results show that our method is efficient and effective in detecting slow-paced persistent activities even in a noisy environment with legitimate traffic.

Although there are various wireless access network technologies with different characteristics and performance level have been developed, no single network that can satisfy the anytime, anywhere, and any service wireless access needs of mobile users. A truly seamless mobile environment can only be realized by considering vertical and horizontal handoffs together. With the advantages of Mobile IPv6, a more comprehensive and integrated framework of heterogeneous networks can be developed. In this paper, we discuss the issues related to handoffs including horizontal and vertical handoffs. We present a scheme for integrating wireless local area network and wide area access networks, and propose a micromobility management method called HiMIPv6+. We also propose a QoS-based (quality-of-service-based) vertical handoff scheme and algorithm that consider wireless network transport capacity and user service requirement. Our prototype evaluations and the simulations show that our framework performs as expected.