Observing the Application-Layer DDoS Attacks for Prevalent Websites
نویسندگان
چکیده
Distributed denial of service (DDoS) attack is a continuous critical threat to the Internet. Derived from the low layers, new application-layer-based DDoS attacks utilizing legitimate HTTP requests to overwhelm victim resources are more undetectable. The case may be more serious when such attacks mimic or occur during the flash crowd event of a popular Website. Focusing on the detection for such new DDoS attacks, a scheme based on document popularity is introduced. An Access Matrix is defined to capture the spatial-temporal patterns of a normal flash crowd. Principal component analysis and independent component analysis are applied to abstract the multidimensional Access Matrix. A novel anomaly detector based on hidden semi-Markov model is proposed to describe the dynamics of Access matrix and to detect the attacks. The entropy of document popularity fitting to the model is used to detect the potential application-layer DDoS attacks. Numerical results based on real Web traffic data are presented to demonstrate the effectiveness of the proposed method. Key Terms: Application-layer, distributed denial of service (DDoS), popular Website.
منابع مشابه
A Review Of Detection of DDOS Attack Using Entropy Based Approach
Web-sites acts as the best platforms for attacks like DDOS attack worm propagation and many other attacks which are related to application layer. To detect application layer DDOS attack is a cumbersome task. It is basically originated from the lower layer i.e. network layer and transport layer. Whereas this new application layer based DDOS attacks utilizes genuine HTTP request to make victim re...
متن کاملSurvey on Application Layer DDoS Attacks
DDoS attacks are the process of making the target system non-responsive to the legitimate requests. They were focusing on network and transport layers initially. Now the application layer DDoS attacks are prominent and are most difficult to resolve online. This paper presents a comprehensive study on Botnet-based DDoS attacks on application layer, and the extended incidents of such attacks that...
متن کاملKadCache: Employing Kad to Mitigate Flash Crowds and Application Layer DDoS Attacks Against Web Servers
Flash crowds or application layer DDoS attacks can severely degrade the availability of websites. Peer-to-peer (P2P) networks have been exploited to amplify DDoS attacks, but we believe their available resource, such as distributed storage and network bandwidth, can be used to mitigate both flash crowds and DDoS attacks. In this poster, we propose a server initiated approach to employing the P2...
متن کاملF-STONE: A Fast Real-Time DDOS Attack Detection Method Using an Improved Historical Memory Management
Distributed Denial of Service (DDoS) is a common attack in recent years that can deplete the bandwidth of victim nodes by flooding packets. Based on the type and quantity of traffic used for the attack and the exploited vulnerability of the target, DDoS attacks are grouped into three categories as Volumetric attacks, Protocol attacks and Application attacks. The volumetric attack, which the pro...
متن کاملSequence-order-independent network profiling for detecting application layer DDoS attacks
Distributed denial of service (DDoS) attacks, which are a major threat on the Internet, have recently become more sophisticated as a result of their ability to exploit application-layer vulnerabilities. Most defense methods are designed for detecting DDoS attacks on IP and TCP layers and consequently have difficulty in detecting this new type of DDoS attack. With the profiling of web browsing b...
متن کامل