Group Testing Based Detection of Web Service DDoS Attackers

Abstract

SUMMARY The Distributed Denial of Service attack (DDoS) is one of the major threats to network security that exhausts network bandwidth and resources. Recently, an efficient approach Live Baiting was proposed for detecting the identities of DDoS attackers in web service using low state overhead without requiring either the models of legitimate requests nor anomalous behavior. However, Live Baiting has two limitations. First, the detection algorithm adopted in Live Baiting starts with a suspects list containing all clients, which leads to a high false positive probability especially for large web service with a huge number of clients. Second, Live Baiting adopts a fixed threshold based on the expected number of requests in each bucket during the detection interval without the consideration of daily and weekly traffic variations. In order to address the above limitations, we first distinguish the clients activities (Active and Non-Active clients during the detection interval) in the detection process and then further propose a new adaptive threshold based on the Change Point Detection method, such that we can improve the false positive probability and avoid the dependence of detection on sites and access patterns. Extensive trace-driven simulation has been conducted on real Web trace to demonstrate the detection efficiency of the proposed scheme in comparison with the Live Baiting detection scheme.

Detection of Distributed Denial of Service Flooding Attack Using Odds Ratio

“…In the SYN flooding attack, the attacker send a high rate of half-open connection requests(SYN packets). These packets consume the server resources [35], [36], thus the services are denied which lead to failure of the server's main mission towards the legitimate users.…”

Detection of Application Layer DDoS Attack Based on SIS Epidemic Model

“…The DDoS attacks prevent legitimate users from using their service by exhausting network resources such as routers, links, and servers [5]. The DDoS attack starts when the attacker compromises relay hosts called masters, which in turn compromise attack machines called agents.…”

“…1. During attack time, the attacker sends a high rate of HTTP requests to the target server by using any possible request method to exhaust server resources (e.g., Sockets, CPU, memory, disk/database bandwidth, and I/O bandwidth) [5], [8]. Thus the server can not respond to any incoming legitimate requests.…”

“…Since the HTTP service is being widely used by most internet applications, it is not easy to close inward ports but VOLUME 4, 2016 FIGURE 1. Architecture of HTTP Flooding attack [5] it is highly desirable to propose efficient detection techniques for HTTP flooding attack.…”

Detection of Application layer DDoS Attacks Based on Bayesian Classifier

“…servers) through attacker or his slaves (agents). This huge number of requests exhausts the server resources and makes it unable to response to the incoming requests [6,7]. The available detection schemes for HTTP flooding attack in most cases depend on two techniques.…”