HADM: detection of HTTP GET flooding attacks by using Analytical hierarchical process and Dempster–Shafer theory with MapReduce

Abstract

The exponential growth in Internet usage causes cyber attack incidents. Among the various kinds of attacks, HTTP GET flooding attack is one of the major threats to the Internet services, as it depletes the resources and services in the application layer. It is difficult to distinguish between the legitimate traffic and malicious traffic from log file traces because the request patterns of attacks are similar to legitimate clients. The various techniques used for the detection of HTTP GET flooding attack are pattern analysis, entropy method, network-based access control mechanism, etc. These techniques use the predefined rules obtained from the traffic patterns to detect the attack and may result in false positives. Hence, to overcome this drawback, the rules are needed to be updated for new traffic patterns caused by the attacks that may lead to more processing time. In order to mitigate this issue, the proposed method uses web server logs instead of traffic patterns. The proposed method reads the web server logs, extracts the relevant features and uses analytical hierarchical process to predict whether the attack has occurred or not and detects the suspicious sources by using Dempster-Shafer theory of evidence. The experimental results are compared with existing approaches such as Snort Intrusion Detection System (IDS), page access behaviour, entropy method and auto-regressive model. The experimental results demonstrate that the proposed method (HADM) achieves a high detection rate, reduces false alarms and takes less processing time by using MapReduce.

Detection System of HTTP DDoS Attacks in a Cloud Environment Based on Information Theoretic Entropy and Random Forest

“…To validate the obtained results, the proposed approach is compared with the state-of-the-art HTTP DDoS detection methods given in [14][15][16][17][18]. For this purpose we used 60% of the dataset for training and 40% for testing as it is the commonly datasets splitting configuration used in the literature.…”

“…The performances of the entire proposed approach are assessed and compared with the performances of different classifiers tested directly on the dataset without the time sliding window entropy estimation algorithm. Furthermore, the obtained results of the proposed system are compared with the state-of-the-art HTTP DDoS detection methods given in [14][15][16][17][18].…”

“…Sree et al [18] have proposed to detect HTTP GET flooding attack by reading the web server logs, extracting the relevant features and using analytical hierarchical process to predict whether the attack has occurred or not, and detecting the suspicious sources by using Dempster-Shafer theory of evidence. The authors use MapReduce techniques to analyze large volumes of log data which allows improving the processing time of their method.…”

“…The authors use MapReduce techniques to analyze large volumes of log data which allows improving the processing time of their method. The method was evaluated using the public Cyber Research Centre (CDX) dataset [18] and a dataset generated locally by authors.…”

Review of Recent Detection Methods for HTTP DDoS Attack

“…e continuity of such requests at a higher rate will collapse a web server as it is unable to process a valid HTTP GET request. Beitollahi and Deconinck [24] and Sree and Bhanu [25] mentioned that an HTTP GET flood attack can stress bandwidth and outbound traffic, memory, CPU cycles, and input and output devices.…”