Detection of Economic Denial of Sustainability Using Time Spent on a Web Page in Cloud

Abstract

Cloud computing is a form of utility computing where the consumers leverage computing resources. Billing is done on an hourly basis based on the amount of resources consumed. In the case of web servers the cost is based on the amount of data that leaves the web server and the number of HTTP requests received.The cloud service provider automatically scales the resources when there is a hike in consumers traffic and the cost on the consumer increases accordingly. This model can put cloud at risk by a tactful attacker who intends to lessen the profit and increase the cost for a consumer. The attacker synthetically generates HTTP requests to the web application so that they are accounted for billing but are not profitable to application provider. Thus, causing a sustainable decline in the economy of the consumer, technically named as Economic Denial of Sustainability(EDoS). The http traffic generated by the attacker mimics the genuine traffic in order to go undetected. This paper proposes a detection mechanism based on the Time Spent on a Web Page(TSP) defined as time spent on viewing a web page. The TSP of the attack traffic differs from the mean TSP of a web page. This deviation of TSP from the mean is calculated taking the exponential distribution of the TSPs and the calculated value is used to detect the surreptitious behavior.

An SVM-based framework for detecting DoS attacks in virtualized clouds under changing environment

“…A good client will follow a pattern that reflects normal activity on the web, while a bad client will show some abnormal activities. Similarly, Anusha et al [8] study the behavior of normal users of Web applications. They assume that an attacker spends a very short time (almost zero) over a Web page.…”

“…In this paper, we shed light on the problem of detecting cloud-based DoS attacks under a changing environment. Although several advanced approaches have been proposed to detect DoS attacks in virtualized cloud (e.g., [6][7][8][9]), these approaches still causes a significant decrease in the detection accuracy when used in a cloud environment. The reason is that the current approaches do not consider the changing environment, that characterises the cloud as a result of its inherent characteristics (resources restriction and scaling).…”

DDoS attacks in cloud computing: Issues, taxonomy, and future directions

“…Outliers are identified, which deviate from these profiles. Authors in [61] argued that an attacker would not spend any time on a page but would request them like a flood. They have gathered TSP behavior of users as well as of bots and identified that the attackers TSP is mostly negligible or even if it is not near zero, it is constant or periodic.…”

Mitigating Economic Denial of Sustainability Attacks to Secure Cloud Computing Environments

“…The system switches to suspected mode and called scrubber Service which generate a puzzle to check legitimacy of the client. In [18], the authors proposed WebSOS to protect web servers by using a filtering mechanism that admits HTTP traffic from only trusted sources known to overlay nodes, to tell Computers and Humans Apart Legitimate clients have to first pass the Completely Automated Public Turing test (CAPTCHA) [19]. The proposed WebSOS presents the performance degradation due to non direct routing, and also CAPTCHA is being challenged today by bots with the appearance of many algorithms that cracks CAPTCHAs such as Google Maps street address, which reading the algorithm with 99.8 percent accuracy.…”