Behavior-based detection of application layer distributed denial of service attacks during flash events

Abstract

Distributed denial of service (DDoS) attacks are ever threatening to the developers and users of the Internet. DDoS attacks targeted at the application layer are especially difficult to be detected since they mimic the legitimate users' requests. The situation becomes more serious when they occur during flash events. A more sophisticated algorithm is required to detect such attacks during a flash crowd. A few existing works make use of flow similarity for differentiating flash crowds and DDoS, but flow characteristics alone cannot be used for effective detection. In this paper, we propose a novel mechanism for discriminating DDoS and flash crowds based on the combination of the parameters reflecting their behavioral differences. Flow similarity, client legitimacy, and web page requested are identified as the principal parameters and are used together for effective discrimination. The proposed mechanism is implemented on resilient proxies in order to protect the server from direct flooding and to improve the overall performance. The real datasets are used for simulation, and the results are presented to evaluate the performance of the proposed system. The results show that the proposed mechanism does effective detection with fewer false positives and false negatives.

An Inter-Domain Attack Mitigating Solution

“…Kurt et al's study was about detecting SIP-based DDoS attacks [9]. Saravanan et al worked on a system for the detection of application layer DDoS attacks [10]. In addition, several studies have been conducted in attack detection and mitigation techniques on fog [11,12] and cloud computing [13,14].…”

Bit-and-Piece DDoS attack Detection based on the Statistical Metrics

“…In this method early detect the DDoS attacks. The authors [7] have proposed a concept for detecting DDoS attack and the Flash events based on the 3 key parameters, flow similarity, pages referred, and client legitimacy. The result of proposed method achieves reduced false positive and false negative.…”

Review of Recent Detection Methods for HTTP DDoS Attack

“…DDoS attack at the application layer focuses on sending large amounts of GET request to a web server, and detection of this attack becomes more complicated when flash crowd is implemented. A flash crowd refers to the increasing number of legitimate HTTP GETrequest received by a web server due to several events, such as result announcements, new product launches, and breaking news [14]. Iyengar and Ganapathy [15] mentioned that flash crowds occur when plenty of authentic concurrent incoming connections are received by a web server in a short period of time.…”