RESUMO
The pernicious impact of malicious Slow DoS (Denial of Service) attacks on the application layer and web-based Open Systems Interconnection model services like Hypertext Transfer Protocol (HTTP) has given impetus to a range of novel detection strategies, many of which use machine learning (ML) for computationally intensive full packet capture and post-event processing. In contrast, existing detection mechanisms, such as those found in various approaches including ML, artificial intelligence, and neural networks neither facilitate real-time detection nor consider the computational overhead within resource-constrained Internet of Things (IoT) networks. Slow DoS attacks are notoriously difficult to reliably identify, as they masquerade as legitimate application layer traffic, often resembling nodes with slow or intermittent connectivity. This means they often evade detection mechanisms because they appear as genuine node activity, which increases the likelihood of mistakenly being granted access by intrusion-detection systems. The original contribution of this paper is an innovative Guardian Node (GN) Slow DoS detection model, which analyses the two key network attributes of packet length and packet delta time in real time within a live IoT network. By designing the GN to operate within a narrow window of packet length and delta time values, accurate detection of all three main Slow DoS variants is achieved, even under the stealthiest malicious attack conditions. A unique feature of the GN model is its ability to reliably discriminate Slow DoS attack traffic from both genuine and slow nodes experiencing high latency or poor connectivity. A rigorous critical evaluation has consistently validated high, real-time detection accuracies of more than 98% for the GN model across a range of demanding traffic profiles. This performance is analogous to existing ML approaches, whilst being significantly more resource efficient, with computational and storage overheads being over 96% lower than full packet capture techniques, so it represents a very attractive alternative for deployment in resource-scarce IoT environments.
RESUMO
BACKGROUND: In Ontario, Canada, there currently are no prehospital treat-and-release protocols and the safety of this practice remains unclear. We sought to describe the characteristics, management, and outcomes of patients with hypoglycemia treated by paramedics, and to determine the predictors of repeat access to prehospital or emergency department (ED) care within 72 hours of initial paramedic assessment. METHODS: We performed a health record review of paramedic call reports and ED records over a 12-month period. We queried prehospital databases to identify cases, which included all adult patients (≥ 18 years) with a prehospital glucose reading of <72mg/dl (4.0mmol/L) and excluded terminally ill and cardiac arrest patients. We developed and piloted a standardized data collection tool and obtained consensus on all data definitions before initiation of data extraction by trained investigators. Data analyses include descriptive statistics with standard deviations, Chi-square, t-tests, and logistic regression with adjusted odds ratios (AdjOR). RESULTS: There were 791 patients with the following characteristics: mean age 56.2, male 52.3%, known diabetic 61.6%, on insulin 46.1%, mean initial glucose 50.0 dl/mg (2.8 mmol/L), from home 56.3%. They were treated by an Advanced Care Paramedic 80.1%, received IV D50W 38.0%, IM glucagon 18.3%, PO complex carbs 26.6%, and accepted transport to hospital 69.4%. Of those transported, 134/556 (24.3%) were admitted and 9 (1.6%) died in the ED. Overall, 43 patients (5.4%) had repeat access to prehospital/ED care, among those, 8 (18.6%) were related to hypoglycemia. Patients on insulin were less likely to have repeat access to prehospital/ED care (AdjOR 0.4; 95%CI 0.2-0.9). This was not impacted by initial (or refusal of) transport (AdjOR 1.1; 95%CI 0.5-2.4). CONCLUSION: Although risk of repeat access to prehospital/ED care for patients with hypoglycemia exists, it was less common among patients taking insulin and was not predicted by an initial refusal of transport.