The Slow HTTP DDOS Attacks: Detection, Mitigation and Prevention in the Cloud Environment

Abstract

Cloud computing is the latest buzzword and cutting-edge technology. The cost-efficiency, easy to operate, on-demand services, availability, makes the cloud so popular. The online web applications based on the internet such as E-Healthcare, E-Commerce are moving to the cloud to reduce the operating investment cost. These applications are vulnerable to slow HTTP Distributed Denial of Service (DDoS) attack in the cloud. This kind of attacks aims to consume the resources of the application as well as the hosting system so that to bring down the services. The various forms of the slow HTTP DDoS are HTTP header attack, HTTP body attack and HTTP read attack. Due to the nature of mimicking the slow network behaviour, this attack is very challenging to detect. This is even more difficult to identify in the cloud environment as it has multiple attack paths. Theweb applications running in the cloud should have been safeguarded from the slow HTTP DDoS attacks. This paper proposed a novel multi-stage zone-based classification model to identify, mitigate and prevent the slow HTTP DDoS attacks in the cloud environment. The solution is implemented using the OpenStack cloud environment. The open-source slowHTTPTest tool is used to generate different types of slow HTTP DDoS attacks.

A Review on Distributed Denial of Service Attack

“…Zsolt Bederna. Tamas Szadeczky [3] analyse what is the bot and botnet and role of botnet in DDOS attack and it said detail about the application of botnet and explain detailed in lifecycle of botnet. Here also author discuss important malware VPN filter and also detail description about the APT28 group.…”

“…Botnets increasingly common tens or hundreds of thousands of its needs. There is no upper limits of bots [3,13,14].…”

“…In this phase bots are commanded to downloaded and update binary. Fig.3clearly explain the architecture of botnet [3]. 3.2 Botnet ArchitectureThe botnet architecture is based on Client Server approach.…”

Detection of Slow DDoS Attacks based on User’s Behavior Forecasting

“…The solution allows to detect Slow HTTP Header Attacks (Slowloris), Slow HTTP Body Attacks (RUDY) or Slow HTTP Read Attacks. Another their work [2] proposes a new classification model for mitigating attacks in the cloud. At the same time, such approaches do not guarantee the effective detection of attacks in the early stages of their development.…”