Mitigating denial of service attack using CAPTCHA mechanism

Mehra, Monika; Agarwal, Mayank; Pawar, Renuka; Shah, D.

doi:10.1145/1980022.1980086

Cited by 18 publications

(8 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Authentication control method: the analysis of web user behavior is executed using authentication control by implementing completely automated public Turing test to tell computers and humans apart (CAPTCHA) or Are You A Human (AYAH) to identify the attackers and legitimate users 22,23 …”

Section: Methodsmentioning

confidence: 99%

A survey and meta‐analysis of application‐layer distributed denial‐of‐service attack

Odusami

Misra

Abayomi‐Alli

et al. 2020

Int J Communication

View full text Add to dashboard Cite

SummaryBackgroundOne of the significant attacks targeting the application layer is the distributed denial‐of‐service (DDoS) attack. It degrades the performance of the server by usurping its resources completely, thereby denying access to legitimate users and causing losses to businesses and organizations.AimThis study aims to investigate existing methodologies for application‐layer DDoS (APDDoS) attack defense by using specific measures: detection methods/techniques, attack strategy, and feature exploration of existing APDDoS mechanisms.MethodologyThe review is carried out on a database search of relevant literature in IEEE Xplore, ACM, Science Direct, Springer, Wiley, and Google Search. The search dates to capture journals and conferences are from 2000 to 2019. Review papers that are not in English and not addressing the APDDoS attack are excluded. Three thousand seven hundred eighty‐nine studies are identified and streamlined to a total of 75 studies. A quantifiable assessment is performed on the selected articles using six search procedures, namely: source, methods/technique, attack strategy, datasets/corpus, status, detection metric, and feature exploration.ResultsBased on existing methods/techniques for detection, the results show that machine learning gave the highest proportion with 36%. However, assessment based on attack strategy shows that several studies do not consider an attack form for deploying their solution. Result based on existing features for the APDDoS detection technique shows request stream during a user session and packet pattern gave the highest result with 47%. Unlike packet header information with 33%, request stream during absolute time interval with 12% and web user features 8%.ConclusionResearch findings show that a large proportion of the solutions for APDDoS attack detection utilized features based on request stream during user session and packet pattern. The optimization of features will improve detection accuracy. Our study concludes that researchers need to exploit all attack strategies using deep learning algorithms, thus enhancing effective detection of APDDoS attack launch from different botnets.

show abstract

Section: Methodsmentioning

confidence: 99%

A survey and meta‐analysis of application‐layer distributed denial‐of‐service attack

Odusami

Misra

Abayomi‐Alli

et al. 2020

Int J Communication

View full text Add to dashboard Cite

show abstract

“…With p = 85% the numbers of n and k would need to be increased to (37,5), (33,7), (32,9), or (31,11); with p = 90% the numbers of n and k would need to be increased to (57,5), (52,7), (49,9), or (48,11). In both cases, the number n of images needed to keep the attacker's success probability below 1% exceeds 25. To sum up, our analysis reveals that Farett-Gender is secure with regard to brute force attacks.…”

Section: Farett-gendermentioning

confidence: 99%

“…The need for protecting web services from unauthorized access is high, as several incidents have shown [64,57,62,73].…”

Section: Introductionmentioning

confidence: 99%

Development of two novel face-recognition CAPTCHAs: A security and usability study

Schryen

Wagner

Schlegel

2016

Computers & Security

View full text Add to dashboard Cite

CAPTCHAs are challenge-response tests that aim at preventing unwanted machines, including bots, from accessing web services while providing easy access for humans. Recent advances in artificial-intelligence based attacks show that the level of security provided by many state-ofthe-art text-based CAPTCHAs is declining. At the same time, techniques for distorting and obscuring the text, which are used to maintain the level of security, make text-based CAPTCHAs difficult to solve for humans, and thereby further degrade usability. The need for developing alternative types of CAPTCHAs which improve both, the current security and usability levels, has been emphasized by several researchers.With this study, we contribute to research through (1) the development of two new face recognition CAPTCHAs (Farett-Gender and FarettGender&Age), (2) the security analysis of both procedures, and (3) the provision of empirical evidence that one of the suggested CAPTCHAs (FarettGender) is similar to Google's reCAPTCHA and better than KCAPTCHA concerning effectiveness (error rates), superior to both regarding learnability and satisfaction but not efficiency.

show abstract

“…The most popular authentication method among these is CAPTCHA [7], however, it annoys users, as they are required to enter some visually distorted characters so often in a designed blank prompt. It is also ineffective since smart bots can solve such kinds of CAPTCHA puzzles by using Artificial Intelligence (AI) with 99.8% accuracy [8].…”

Section: B Web Traffic Source Authenticationmentioning

confidence: 99%

Web Server Protection against Application Layer DDoS Attacks Using Machine Learning and Traffic Authentication

Ndibwile

Govardhan

Okada

et al. 2015

2015 IEEE 39th Annual Computer Software and Applications Conference

View full text Add to dashboard Cite

Application layer Distributed Denial of Service (DDoS) attacks are among the deadliest kinds of attacks that have significant impact on destination servers and networks due to their ability to be launched with minimal computational resources to cause an effect of high magnitude. Commercial and government Web servers have become the primary target of these kinds of attacks, with the recent mitigation efforts struggling to deaden the problem efficiently. Most application layer DDoS attacks can successfully mimic legitimate traffic without being detected by Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). IDSs and IPSs can also mistake a normal and legitimate activity for a malicious one, producing a False Positive (FP) that affects Web users if it is ignored or dropped. False positives in a large and complex network topology can potentially be dangerous as they may cause IDS/IPS to block the user's benign traffic.Our focus and contributions in this paper are first, to mitigate the undetected malicious traffic mimicking legitimate traffic and developing a special anti-DDoS module for general and specific DDoS tools attacks by using a trained classifier in a random tree machinelearning algorithm. We use labeled datasets to generate rules to incorporate and fine-tune existing IDS/IPS such as Snort. Secondly, we further assist IDS/IPS by processing traffic that is classified as malicious by the IDS/IPS in order to identify FPs and route them to their intended destinations. To achieve this, our approach uses active authentication of traffic source of both legitimate and malicious traffic at the Bait and Decoy server respectively before destined to the Web server.

show abstract

Mitigating denial of service attack using CAPTCHA mechanism

Cited by 18 publications

References 5 publications

A survey and meta‐analysis of application‐layer distributed denial‐of‐service attack

A survey and meta‐analysis of application‐layer distributed denial‐of‐service attack

Development of two novel face-recognition CAPTCHAs: A security and usability study

Web Server Protection against Application Layer DDoS Attacks Using Machine Learning and Traffic Authentication

Contact Info

Product

Resources

About