SDToW: A Slowloris Detecting Tool for WMNs

Abstract

Denial of service (DoS) attacks play a significant role in contemporary cyberspace scenarios. A variety of different DoS attacks pollute networks by exploring various vulnerabilities. A group of DoS called application DoS attacks explore application vulnerabilities. This work presents a tool that detects and blocks an application DoS called Slowloris on wireless mesh networks (WMNs). Our tool, called SDToW, is designed to effectively use the structure of the WMNs to block the Slowloris attack. SDToW uses three different modules to detect and block the attack. Each module has its specific tasks and thus optimizes the overall detection and block efficiency. Our solution blocks the attacker on its first WMN hop, reducing the malicious traffic on the network and avoiding further attacks from the blocked user. The comparison results show that SDToW performs with 66.7% less processing consumption and 89.1% less memory consumption than Snort. Our solution does not limit the number of parallel connections per user. Hence, by avoiding this limitation, SDToW has a lower incidence of false positive errors than Snort.

A Reliable Real-Time Slow DoS Detection Framework for Resource-Constrained IoT Networks

“…3 from which it is observed that packets in the range [40, 79] bytes occur with the highest frequency. This particular range, which contains both SYN and ACK packets, has the highest proportion of traffic, with LN, SN and MN traffic appearing similar, so corroborating the judgement [16] that Slow DoS attack detection for reliable IDS is problematic when attempting to differentiate between LN and MN, with SN often being misclassified as Slow DoS attacks.…”

“…The range value is specified in bytes, i.e., 0-50 and the attacker compromises the range request header by requesting a long stream of bytes, where some are illegally overlapping so forcing the server to waste resources. • Slowloris: the attacker sends partial HTTP GET requests, and the server opens a connection, but the attacker deliberately fails to respond to the server to complete the connection and holds the socket open until the timeout value is reached [16]. Multiple connection requests can then occupy all the available web server sockets.…”

Generator of Slow Denial-of-Service Cyber Attacks

“…Only when the number of such connections is exceeded and it could disrupt the stability of the server should the mitigation technique block the connection and release the server’s occupied resources. Thus, it is possible to use specialized tools for the detection and mitigation of individual attacks, such as the SDToW tool [ 44 ]. This tool is for the detection and mitigation of Slowloris attacks in wireless mesh networks using a device called a concentrator.…”

Detection and Mitigation of Low-Rate Denial-of-Service Attacks: A Survey

“…Faria et al in [116] HTTP GET method, The Reassembled SDToW Victim Real environment Lower incidence of false positive errors PDU and the Packets with 296 bytes and TCP set on protocol field the authors' algorithm was better at detecting the slowloris attack, reaching 98% of accuracy.…”

“…Faria et al in [116] developed a tool which they called SD-ToW (Slowloris Detecting Tool for WMNs) that detected and blocked slowloris attack traffic in wireless mesh networks (WMNs). First, they analyzed the slowloris traffic behavior.…”