Agile method for detecting DDoS attacks in the application layer based on user’s dynamism

Abstract

Abstract-DDoS attacks are one of the most damaging computer attacks of recent times. Attackers send large number of requests to saturate a victim machine and it stops providing its services to legitimate users. In general attacks are directed to the network layer and the application layer, the latter has been increasing due mainly to its easy execution and difficult detection. The present work proposes a low cost detection approach that consists of two steps: first, user characteristics are extracted in real time while browsing the web application; second, each extracted feature is used by an order sorter O(1) to differentiate a real user from a DDoS attack. A real user is identified by making requests using peripherals for navigation (user dynamism), while DDoS attacks are requests sent by robots and do not require the use of peripherals to make requests, therefore the characteristics of the user's dynamism are used for the detection of a DDoS attack. The results on the attack tests using the attack tools LOIC, OWASP and GoldenEye, show that the proposed method has a detection efficiency of 100%, and that the characteristics of the web user allow to differentiate between a real user and a robot.Keyword -Application layer, DDoS, user's dynamism, detection attacks, use of peripherals I. INTRODUCTION DDoS attacks have become one of the threats with the greatest impact on the security of computer systems. These attacks are aimed at consuming bandwidth or server resources, preventing legitimate users from accessing the services. These attacks can be in the network layer (protocols, hubs, switch) and in the application layer (system, CPU, resources), the latter has increased in recent years due to its easy execution and difficult detection, thus, the efforts in the mechanisms of detection are focusing to this type of attack. The attacks directed to the application layer are considered sophisticated because they mimic the requests of real users, so it is more difficult to detect them. The methods consider information of user requests, and some logic that allows to relate these with an attack or a user. The logic is given by techniques such as neural networks, genetic algorithms, support vector machine and statistical models that in general consume considerable resources. The excessive consumption of resources means that the detection process is slower and even more so with large amounts of information. The slowness of the process impacts the system causing saturation of the bandwidth and consumption of server resources. In addition, the mentioned techniques have a waiting time before detection, to know if it is an attack, which affects the productivity of the services. The most difficult task that detection methods have is to differentiate a request to identify it as a real user or attack. In [1] they introduces the characteristics of the user's dynamism, indicating that they come from the interaction between the user and the system. In [2] they specify that the characteristics of the user's dynamism allow differentia...