Mitigation of Random Query String DoS via Gossip

Abstract

This paper presents a mitigation scheme to cope with the random query string Denial of Service (DoS) attack, which is based on a vulnerability of current Content Delivery Networks (CDNs). The attack exploits the fact that edge servers composing a CDN, receiving an HTTP request for a resource with an appended random query string never saw before, ask the origin server for a (novel) copy of the resource. Such characteristics can be employed to take an attack against the origin server by exploiting edge servers. Our strategy adopts a simple gossip protocol executed by edge servers to detect the attack. Based on such a detection, countermeasures can be taken to protect the origin server and the CDN against the attack. We provide simulation results that show the viability of our approach.

DDoS Attacks With Randomized Traffic Innovation: Botnet Identification Challenges and Strategies

“…REMARK I. From (5) and (6) we see that increasing the EDR α and/or the transmission rate λ corresponds to increasing the MIR. Besides, the MIR is always smaller 1 REMARK II.…”

“…Recently, the new class of application-layer DDoS attacks is emerging as one of the most powerful threats [3]- [6]. In such attacks, the malicious traffic patterns are disguised as normal ones by leveraging the many possibilities offered at the application layer (for instance, when surfing through a website, more and more web-pages are likely to be explored as time elapses).…”

“…policies, the empirical MIR of a botnet with reference EDR value(22) does always provide a lower bound to the sum of individual MIRs 6. …”

Botnet identification in multi-clustered DDoS attacks

“…Our model for multi-clustered DDoS is inspired to recent kinds of application-layer DDoS [3], [4], and is a generalization of the DDoS class originally proposed in [1]. We assume that the botnet is made of C non-overlapping clusters, each of which has access to an emulation dictionary (at time t) denoted by E c (t), for c = 1, 2, .…”

“…This peculiar form of attacks goes beyond the simplest repetition-based attacks, by exploiting the ample range of possibilities available at the application layer [3], [4]. In such novel attacks, the bots choose randomly their requests from a set of admissible messages (an emulation dictionary), trying so to disguise their traffic patterns as normal ones.…”