Mitigating Slow Hypertext Transfer Protocol Distributed Denial of Service Attacks in Software Defined Networks

Abstract

Distributed Denial of Service (DDoS) attacks has been one of the persistent forms of attacks on information technology infrastructure connected to public networks due to the ease of access to DDoS attack tools. Researchers have been able to develop several techniques to curb volumetric DDoS which overwhelms the target with a large number of request packets. However, compared to slow DDoS, limited number of research has been executed on mitigating slow DDoS. Attackers have resorted to slow DDoS because it mimics the behaviour of a slow legitimate client thereby causing service unavailability. This paper provides the scholarly community with an approach to boosting service availability in web servers under slow Hypertext Transfer Protocol (HTTP) DDoS attacks through attack detection using Genetic Algorithm and Support Vector Machine which facilitates attack mitigation in a Software-Defined Networking (SDN) environment simulated in GNS3. Genetic algorithm was used to select the Netflow features which indicates the presence of an attack and also determine the appropriate regularization parameter, C, and gamma parameter for the Support Vector Machine classifier. Results obtained showed that the classifier had detection accuracy, Area Under Receiver Operating Curve (AUC), true positive rate, false positive rate and a false negative rate of 99.89%, 99.89%, 99.95%, 0.18%, and 0.05% respectively. Also, the algorithm for subsequent implementation of the selective adaptive bubble burst mitigation mechanism was presented. This study contributes to the ongoing research in detecting and mitigating slow HTTP DDoS attacks with emphasis on the use of machine learning classification and meta-heuristic algorithms.

An intelligent system to detect slow denial of service attacks in software-defined networks

“…ML algorithms such as SVM, NB, artificial neural network (ANN), and KNN are used along with feature selection methods based on thresholds. To identify attacks, Studies [20], [21] used Chi-square test and information gain feature selection mechanisms, as well as NB, SVM, C4.5, K-NN, K-means, fuzzy C-means, and a number of other models. A system that extracts only important attributes from network traffic in a computer network is proposed in [22].…”

Feature Selection of Distributed Denial of Service (DDos) IoT Bot Attack Detection Using Machine Learning Techniques

“…There are many ML techniques and algorithm classifier and method has been applied to increase DDoS attack detection. Akanji [12] uses Genetic algorithm and SVM and NetFlow dataset to detect a slow HTTP DDoS attack. Awan [13] use Random Forest, MLP and Scikit with SparkML dataset to get the DDoS attack detection in real-time.…”

Comparison of Memory usage between REST API in Javascript and Golang

“…Its ability to transmit data or information across platforms is due to its utilization of an environment distinct from other apps. The hypertext transfer protocol (HTTP) protocol is used by multi-platform applications because it facilitates multi-platform data interchange, such as web apps that can be accessed from all current devices [2]. Web application developers can use the API (Application Programming Interface) to connect the two applications using HTTP methods like get, post, put, and delete.…”