CALD: Surviving Various Application-Layer DDoS Attacks That Mimic Flash Crowd

Abstract

Distributed denial of service (DDoS) attack is a continuous critical threat to the Internet. Derived from the low layers, new application-layer-based DDoS attacks utilizing legitimate HTTP requests to overwhelm victim resources are more undetectable. The case may be more serious when such attacks mimic or occur during the flash crowd event of a popular Website. In this paper, we present the design and implementation of CALD, an architectural extension to protect Web servers against various DDoS attacks that masquerade as flash crowds. CALD provides real-time detection using mess tests but is different from other systems that use resembling methods. First, CALD uses a front-end sensor to monitor the traffic that may contain various DDoS attacks or flash crowds. Intense pulse in the traffic means possible existence of anomalies because this is the basic property of DDoS attacks and flash crowds. Once abnormal traffic is identified, the sensor sends ATTENTION signal to activate the attack detection module. Second, CALD dynamically records the average frequency of each source IP and check the total mess extent. Theoretically, the mess extent of DDoS attacks is larger than the one of flash crowds. Thus, with some parameters from the attack detection module, the filter is capable of letting the legitimate requests through but the attack traffic stopped. Third, CALD may divide the security modules away from the Web servers. As a result, it keeps maximum performance on the kernel web services, regardless of the harassment from DDoS. In the experiments, the records from www.sina.com and www.taobao.com have proved the value of CALD.

Application Layer DDOS Attack Detection Using Hybrid Machine Learning Approach

“…Sheng Wen, et al [6] proposed an architecture extension called CLAD to protect web server against attacks that mimics flash crowd. It uses a front end sensor to monitor incoming traffic.…”

Exploiting Cloud Utility Models for Profit and Ruin

“…Due to the subtle nature of a FRC attack, previous application-layer DDoS solutions that focus on high request intensities will not be suitable for FRC detection [120]. Instead, initial FRC detection approaches focus on behavioral metrics derived from web logs that seek to capture the aggregate web page request choices of a websites client base.…”

“…If the attack intensity increases above J2, the aggregate resource consumption will reach a point when the QoS starts to significantly degrade as the increase resource utilization results in an increase in system response latency. It is at this point detection like, as stated in [56,58,120], current application-layer DDoS detection and mitigation schemes will be activated. The transition point between the inability and ability to detect malicious resource consumption is denoted as J2 on Figure 3.2.…”

“…As the number of attacking resource consumption bots increases, damaging attacks can be mounted without being able to associate a significant usage footprint to a single client, as compared to what was seen in the single attacker scenario. Because current detection efforts are focused on excessive amounts of HTTP requests over a short period of time [56,87,120], as is the case in DDoS attack and flash crowds, it is likely that FRC attacks will go undetected.…”

“…Within this body of work, some have sought to distinguish flash crowds from DDoS attacks [56,120,124]. It was found that the number of overall client requests in a flash crowd was proportional to the number of users [124] and that flash crowds do not exhibit higher per-client request rates [56]; both are behaviors that differ from DDoS attacks.…”