![](https://csdnimg.cn/release/download_crawler_static/14859513/bg4.jpg)
Journal of Communications and Information Networks
146
With CoT, the services are provided in the cloud, and
ubiquitous access is given to users, extending the scope
of service usage, as well as improving accessibility.
CoT affects future application development, where the
information gathering process and transmission will
deliver new challenges to be addressed in a multi-
cloud environment
[21]
.
An SG would provide better help in the utilization
of network and cloud resources. The data collected
from wireless sensor networks would be transmitted
through a gateway to the cloud. Received data are
then stored in the cloud and provided as a service to
users through the cloud. SG must manage various
aspects of underlying IoTs and perform a number
of tasks, such as data collection, preprocessing,
ltering data and reconstructing it into a more useful
form, uploading only necessary data to the cloud,
tracking IoT objects and sensor activities, power
energy consumption, security and privacy of the data,
and overall service monitoring and management.
It is possible that the data gathered from the IoT is
transmitted directly to the SG, or that multiple IoTs
are connected with base station(s), which in turn
transmit data to the SG.
2.2 Botnet and DDoS attack defense
Botnet studies typically focus on four aspects, including
detecting, analyzing, resisting and counterattack.
Botnet detection and analysis receive more additional
attention.
A light-weight mechanism was proposed to detect
botnets by using their fundamental characteristics in
Ref.[22]. It referred to a BotGAD, which requires
a small amount of data from DNS (Domain Name
System) traffic to detect a botnet. The BotGAD can
automatically detect botnets while providing real-time
monitoring in large-scale networks. Ref.[23] used fuzzy
pattern recognition techniques based on frequency to
observe bot behavior. Meanwhile, several researchers
have focused on new botnet technologies for better
botnets analysis and development trend prediction.
Ref.[24] analyzed a new form of P2P (Peer-to-peer
Computing) botnets called AntBot, which aimed to
spread C&C (Command and Control) information to
individual bots even though an adversary persistently
polluted keys used by seized bots to search the C&C
information.
For current DDoS attack and defense studies, as
Ref.[25] shows, not only is there an alarming increase
in the number of DDoS attack incidents, but also the
attack technique, botnet size, and attack trafc, have
attained new heights. Effective defense measures to
mitigate attacks are imminent.
Ref.[26] demonstrated the exploitation pattern of
an inherent weakness in LHAC (Local-Host Alert
Correlation) based methods and asserted that current
LHAC implementations could allow pockets of
cooperative bots to hide in an enterprise-level network
scale. Ref.[27] proposed a graph-based representation
of infected computers, allowing us to use graph-
partitioning algorithms to separate out different botnets,
even in a network infected with varieties of zombie
viruses at the same time. Ref.[28] proposed a method of
detecting DDoS attacks through data mining.
In the new CoT network environment, two problems
should be noticed: 1) A CoT botnet can dynamically
adjust attack strategy to launch a larger scale DDoS
attack using infected smart devices. 2) A dynamic
defense mechanism should be deployed in the SG
against the IoT DDoS attack.
3 Game model
A DDoS attack towards the SG is regarded as
effective, if the adversary can consume the network
resources between AP and SG sharply and massively.
We present our game models for CoT DDoS attacks
and their possible countermeasures. We consider the
interaction between DDoS attacking device master
12-16040-WYC.indd 146 2016-12-27 17:20:30