Mitigation of Application Layer DDoS Flood Attack Against Web Servers
Article content
Abstract
The Application-layer Distributed Denial of Service (App-DDoS) attack is one of the most menacing types of cyberattacks
that circumvent web servers. Since the attackers have developed different techniques and methods, preventing
App-DDoS attacks has become more difficult than ever before. One of the most commonly and targeted protocols in
the application-layer is HTTP-GET flooding attacks. The attacker sends a large number of HTTP-GET requests from
different infected devices to force the server to assign the maximum resources available in response to every single
request. The objective of this attack is to exhaust the server’s resources and deny service to the legitimate users. The
App-DDoS attacks affect Quality of Service (QoS) and are extremely costly in terms of resource exhaustion. In this
paper, we discuss development and testing of an App-DDoS attack detection and mitigation model in order to defend web
servers against threats. Our design model employs three principle states: normal, screening and suspicious. The defense
model transits between these modes based on the server load. We use Machine Learning (ML) techniques to provide
high detection accuracy of App-DDoS attacks. Our experimental results demonstrate that this defense system is effective
against App-DDoS attack.
Keywords
DDoS, Application layer DDoS, App-DDoS Attack, HTTP GET, DDoS Http, Security, App-DDoS Detection, Mitigation, NFV
Downloads
References
K. Singh, P. Singh and K. Kumar, “Application layer HTTPGET flood DDoS attack: Research landscape and challenges,” Comput. Secur., vol. 65, pp. 344-372, Mar. 2017, doi: 10.1016/j.cose.2016.10.005.
K. Singh, P. Singh and K. Kumar, “User behavior analytics-based classification of application layer HTTP-GET flood attacks,” J.Netw. Comput. Appl., vol. 112, pp. 97-114, June 15, 2018, doi:10.1016/j.jnca.2018.03.030.
S. Mansfield-Devine, “The growth and evolution of DDoS,”Netw. Secur., vol. 2015, no. 10, pp. 13-20, Oct. 2015, doi:10.1016/S1353-4858(15)30092-1.
T. Alharbi, A. Aljuhani, H. Liu and C. Hu, “Smart and LightweightDDoS Detection Using NFV,” in Proc. Int. Conf. Comput.Data Anal. (ICCDA ’17), Lakeland, FL, USA, May 2017, pp.220-227, doi: 10.1145/3093241.3093253.
T. Thapngam, S. Yu, W. Zhou and G. Beliakov, "Discriminating DDoS attack traffic from flash crowd through packet arrival patterns," 2011 IEEE Conf. Comput. Commun. Workshops (INFOCOM WKSHPS), Shanghai, 2011, pp. 952-957, doi: 10.1109/INFCOMW.2011.5928950.
eCommerce web site performance today. An updated look at consumer reaction to a poor online shopping experience, 2012.[Online].Available: http://www.damcogroup.com/white papers/ecommerce_website_perf_wp.pdf
ETSI Industry Specification Group, “Network Function Virtualization (NFV); Architectural Framework,” ETSI, France, RGS/NFV-002 V1.2.1, 2014.
A. Aljuhani and T. Alharbi, "Virtualized Network Functions security attacks and vulnerabilities," 2017 IEEE 7th Annu. Comput.Commun. Workshop Conf. (CCWC), Las Vegas, NV, 2017, pp.1-4, doi: 10.1109/CCWC.2017.7868478.
D. Boro and D. K. Bhattacharyya, “DyProSD: a dynamic protocol specific defense for high-rate DDoS flooding attacks,” Microsyst.Technol., vol. 23, no. 3, pp 593-611, May 18, 2016, doi:10.1007/s00542-016-2978-0.
Nicky Woolf, “ DDoS attack that disrupted internet was largest of its kind in history, experts say,” Oct. 26, 2016. [Online] .Available: https://www.theguardian.com/technology/2016/oct/26/ddos-attack-dyn-mirai-botnet (accessed Dec. 2, 2016).
Neustar, “Worldwide DDoS Attacks & Cyber Insights Research Report,” May 2017. [Online].Available: https://www.discover.neustar/201705-Security-Solutions-DDoS-SOC-Report-LP.html
Worldwide infrastructure security report, 2017. [Online].Available:https://www.arbornetworks.com/images/documents/WISR2016_EN_Web.pdf
T. Alharbi, A. Aljuhani and Hang Liu, "Holistic DDoS mitigation using NFV," 2017 IEEE 7th Annu. Comput. Commun. Workshop Conf. (CCWC), Las Vegas, NV, 2017, pp. 1-4, doi: 10.1109/CCWC.2017.7868480.
ClarkNet-HTTP, http://ita.ee.lbl.gov/html/contrib/Clark-Net-HTTP.html.
G. Somani, A. Johri, M. Taneja, U. Pyne, M. S. Gaur and D. Sanghi,“DARAC: DDoS Mitigation Using DDoS Aware Resource Allocation in Cloud,” in Int. Conf. Inf. Syst. Secur., in Information System Security, in Lecture Notes in Computer Science,vol.9478, pp. 263-282, doi: 10.1007/978-3-319-26961-0_16.
K. J. Singh and T. De, "DDOS Attack Detection and Mitigation Technique Based on Http Count and Verification Using CAPTCHA,"2015 Int. Conf. Comput. Intell. Netw., Bhubaneshwar,2015, pp. 196-197, doi: 10.1109/CINE.2015.47.
S. R. Devi and P. Yogesh, “An effective approach to counter application layer DDoS attacks,’ in 2012 Third Conf. Comput.Commun. Netw. Technol. (ICCCNT 2012), Coimbatore, 2012, pp.1-4, doi: 10.1109/ICCCNT.2012.6395941.
Y. Wang, L. Liu, C. Si and B. Sun, "A novel approach for countering application layer DDoS attacks," 2017 IEEE 2nd Adv. Inf.Technol. Electron. Autom. Control Conf. (IAEAC), Chongqing,2017, pp. 1814-1817, doi: 10.1109/IAEAC.2017.8054326.
Q. Le, M. Zhanikeev and Y. Tanaka, "Methods of Distinguishing Flash Crowds from Spoofed DoS Attacks," 2007 Next Generation Internet Netw., Trondheim, 2007, pp. 167-173, doi: 10.1109/NGI.2007.371212.
H. Beitollahi and G. Deconinck, “ConnectionScore: a statistical technique to resist application-layer DDoS attack,” J. Ambient Intell. Humanized Comput., vol. 5, no. 3, pp. 425-442, Jul. 10,2013, doi: 10.1007/s12652-013-0196-5.
Github, DDoS Attack Tools, 2013. [Online].Available: https://github.com/jseidl/GoldenEye
H. Kaur, S. Behal and K. Kumar, "Characterization and comparison of Distributed Denial of Service attack tools," 2015 Int.Conf. Green Comput. Internet Things (ICGCIoT), Noida, 2015,pp. 1139-1145, doi: 10.1109/ICGCIoT.2015.7380634.
Article details
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
You must read and accept the copyright terms and conditions(click here for copyright terms).