A Practical Approach and Mitigation Techniques on Application Layer DDoS Attack in Web Server

Abstract

Denial of Service (DoS) or Distributed Denial of Service (DDoS) is a powerful attack which prevents the system from providing services to its legitimate users. Several approaches exist to filter network-level attacks, but application-level attacks are harder to detect at the host base firewall. Filtering in application level can be computationally expensive and difficult to scale, while DDoS attacks still creating bogus positives that block legitimate users. In this paper, the authors show application layer DoS attack for HTTP web server using some open source DoS attack tools and also suggest some realistic mechanisms that can protect a web server from application-level DoS attacks especially while attacks targeting the resources including CPU, sockets, memory of the victim server. The authors propose a new DDoS defense mechanism that protects http web servers from applicationlevel DDoS attacks based on the reverse proxy. The attack flow detection mechanism detects attack flows based on the symptom or stress at the server, since it is getting more difficult to identify bad flows only based on the incoming traffic patterns. A popular software known as Wireshark which is a network protocol analyzer is used to capture the packets during a DoS attack from the victim server Ethernet interface to detect the attacking host IP address and analysis the types of attack. We evaluate the performance of the proposed scheme via experiment.

Perbandingan Penerapan Metode Pengamanan Web Server Menggunakan Mod Evasive Dan Ddos Deflate Terhadap Serangan Slow Post

“…Denial of Service (DoS) atau Distributed Denial of Service (DDoS) merupakan serangan yang membanjiri server dengan mengirimkan permintaan yang sangat banyak sehingga menghabiskan sumber daya pada server tersebut sampai server tersebut tidak dapat menjalankan fungsi dan tugasnya dengan benar. Kemudian server yang tidak bisa menangani permintaan, maka akan mengalami penolakan layanan (denial of service) (Yeasir, Morshed and Fakrul, 2015).…”

Mitigating Slow Hypertext Transfer Protocol Distributed Denial of Service Attacks in Software Defined Networks

“…Measurement of the stress on the web server was employed by Yeasir et al (2015) to detect slow HTTP attacks. Once the attack was detected, a reverse proxy mechanism would handle all subsequent incoming traffic for the primary web server.…”

“…However, with an increased number of attackers whose number of established connection was below the threshold, the ModSecurity mitigation mechanism was rendered ineffective since the attack could not be detected. Yeasir et al (2015) proposed handling requests on behalf of the client using a reverse proxy server that proved to be a good mitigation mechanism against slow header attacks. In their work, the reverse proxy cached the client request until it was complete before handing the completed request off to the web server.…”

“…Mitigation of the slow HTTP DDoS attack refers to the use of methods that prevent service degradation or resource exhaustion on the web server when an attack is detected by halting or diminishing the rate of attack (Jaafar et al, 2019;Yeasir et al, 2015). Previous volumetric and slow DDoS attack mitigation techniques include redirecting the traffic to a verifying device as identified in the work by Beigi-Mohammadi et al (2017), Lukaseder et al (2018, and Schehlmann and Baier (2013); limiting the rate of attack, which was used by Bhunia and Gurusamy (2017) and Yuan et al (2017); dropping the attack traffic selectively as explored by Fonseca and Nigam (2016); or spreading the traffic to replicas of the attack victim (Ameyed et al, 2015;Sattar et al, 2016).…”

Komparasi Mod Evasive dan DDoS Deflate Untuk Mitigasi Serangan Slow Post

“…DDoS deflate dan mod_evasive telah diuji untuk mitigasi serangan terhadap koneksi http, namun masih perlu dilakukan pengujian terhadap beberapa jenis serangan http menggunakan DDoS deflate dan mod_evasive [3]. Mod_evasive dapat bekerja pada sistem operasi windows dan linux dan mampu melakukan pencegahan serangan DoS berdasarkan parameter tertentu [4].…”