A detection scheme for flooding attack on application layer based on semantic concept

Abstract

With the development of the Internet, application programs on the web page become widespread. Information appearing on the web page has evolved from static presentation to dynamic presentation and even being interactive with the users. Some malicious users employ malicious browsing behaviors, such as flooding attack, to cause waste of resources and bandwidth of the host for the web page. Since the advent of cloud computing technology, flooding attack on the application layer no longer has the ability to cause complete denial of service to a Web server. But resources, such as bandwidth, CPU time, and memory, on the clouds mean cost, and any waste of the resource will generate extra and unnecessary cost. Therefore, in this paper we analyze native modules or components of the PHP dynamic pages and find the amount of system resources consumed by parts of the native module or the whole module. From above analysis, we propose a method based on semantic concept to formulate rules to identify malicious browsing behaviors in order to improve performance of Web services and to slice the cost.

User Activity Based Application-Layer DoS/DDoS Attack Defense Algorithm

“…Lin and Lee, et al [10], proposed a semantic based algorithm based on HTTP protocol and components of PHP dynamic pages. Mudhakar Srivatsa et al [11] introduced a client-transparent approach based on admission control and congestion control to protect Web server from application-layer DoS attacks.…”

Mitigation of Distributed Denial of Service Attacks in the Cloud

“…The first type affects its computational capacity by consuming the system resources. The second type wastes the bandwidth by downloading large files from the web server repeatedly affecting its communication capability while the third type harms its security by using password guessing attacks and SQL Injections (L i n et al [28]). The flooding attacks against a static web page are generated either from botnet, computer virus or any other open Denial of Service tool (Y a t a g a i, I s o h a r a and S a s a s e [61]).…”