Distributed denial-of-service attacks against HTTP/2 services

Abstract

HTTP/2 is the second major version of the HTTP protocol published by the internet engineering steering group. The protocol is designed to improve reliability and performance Such enhancements have thus delineated the protocol as being more vulnerable to distributed denial-of-service (DDoS) attacks when compared to its predecessor. Recent phenomenon showed that legitimate traffic or flash crowds could have high-traffic flow characteristics as seen in DDoS attacks. In this paper, we demonstrate that legitimate HTTP/2 flash crowd traffic can be launched to cause denial of service. To the best of our knowledge, no previous study has been conducted to analyse the effect of both DDoS as well as flash crowd traffic against HTTP/2 services. Results obtained prove the effect of such attacks when tested under four varying protocol-dependant attack scenarios. © 2016, Springer Science+Business Media New York

Denial of service attack detection through machine learning for the IoT

“…Failures were detected in certain versions of the broker software and in client applications. A similar MQTT fuzzer tool known as F-secure Singh et al (2017), Adi et al (2016) and Ranjan et al (2009). b Shan et al (2017).…”

HTTP/2 Cannon: Experimental analysis on HTTP/1 and HTTP/2 request flood DDoS attacks

“…They investigated HTTP/1.1 attacks including request flooding, asymmetric workload and repeat one shot attacks. E Adi et al [9] [10] were the first to analyse the implications of DDoS on HTTP/2. They looked at the flow mechanisms introduced to the application layer and demonstrated attacks relating to the abuse of window sizes to overload the web server due to the management of flows.…”

“…Extensive research has been carried out on previous HTTP versions however currently, the only published work directly relating to HTTP/2 DDoS has been performed by E Adi et al [9][10] and the security vendor Imperva [11] and do not provide a complete coverage of potential attack vectors.…”

HTTP/2 Tsunami: Investigating HTTP/2 proxy amplification DDoS attacks

“…They discovered a amplification factor of 60x which could generate a large amount of attack traffic for DDoS. E Adi et al [10] [11] analysed HTTP/2 and it's risk from DDoS. Their research focused on exploiting the flow mechanisms and setting frames.…”

“…Currently the only published work on HTTP/2 is by E Adi et al [10][11] and the security vendor Imperva [12], however these do not provide complete coverage of the potential attack vectors of HTTP/2.…”