WDA: A Web farm Distributed Denial Of Service attack attenuator

Abstract

Distributed Denial Of Service (DDoS) attacks are familiar threats to Internet users for more than ten years. Such attacks are carried out by a "Bot net", an army of zombie hosts spread around the Internet, that overwhelm the bandwidth toward their victim Web server, by sending traffic upon command. This paper introduces WDA, a novel architecture to attenuate the DDoS attacker's bandwidth. WDA is especially designed to protect Web farms. WDA is asymmetric and only monitors and protects the uplink toward the Web farm, which is the typical bottleneck in DDoS attacks. Legitimate traffic toward Web farms is very distinctive since it is produced by humans using Web browsing software. Specifically, such upload traffic has low volume, and more importantly, has long off times that correspond to human view time. WDA utilizes these properties of legitimate client traffic to distinguish it from attack traffic, which tends to be continuous and heavy. A key feature of WDA is in its use of randomized thresholds that trap and penalize deterministic zombie traffic that tries to mimic human client patterns. WDA's heart is WDAQ, a novel active queue management mechanism aimed to prefer legitimate client traffic over attacker traffic. With WDA installed, the attacker traffic toward the victim is attenuated. Extensive simulation results show that WDA can defeat simple flooding attacks, and can attenuate the bandwidth usable by sophisticated WDA-aware attacks by orders of magnitude. As a consequence, the attacker must increase his "bot-net" size by the same factor, to compensate for the effects of WDA. Our simulations show that WDA can defend a typical Web farm from DDoS attacks launched by hundreds of thousands zombies, while keeping legitimate clients' service degradation under ten percent.

Progressive Transfer Learning-based Deep Q Network for DDOS Defence in WSN

“…Even if packet The work can be extended with real time analysis together with model evaluation. [27,28] communications are confidential, they don't give themselves to DDOS attacks. Classification engine: It is designed by using the convolutional neural network which is executed in the sensor devices and in the basestation to perform the node behaviour classification process.…”

Detecting SYN flooding attacks based on traffic prediction

“…Hence, such no-stationary behavior should be removed before applying CUSUM by the approach in [25]. In addition, to reduce the complex and time-consuming calculations, we consider a simple approach to apply CUSUM tox n , with e x n ¼ x n À m nÀ1 (18) where x n is the number of SYN packets in the nth sample interval and m n is an estimate of the mean SYN traffic at the nth sample interval.…”

“…With the traffic prediction, researchers in proposed some detection schemes, which obtain good effectiveness. Moreover, there are also some other related studies such as active probing technique , Client ACK , Web farm DDoS Attack attenuator , partial completion filters , and Stream Control Transmission Protocol against DoS attacks .…”

Attack Pattern Discovery in Forensic Investigation of Network Attacks

“…type of network traffic), or given as a probabilistic distribution over some sample space (e.g. packet intervals are from a Gamma distribution [33], [34]). For instance, a HTTP denial of service attack session can be modeled by the network profile with the attributes:…”