The week's pick
Random Articles
Reseach Article
A Practical Approach and Mitigation Techniques on Application Layer DDoS Attack in Web Server
| International Journal of Computer Applications |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 131 - Number 1 |
| Year of Publication: 2015 |
| Authors: Muhammad Yeasir Arafat, Muhammad Morshed Alam, Mohammad Fakrul Alam |
10.5120/ijca2015907209
|
Muhammad Yeasir Arafat, Muhammad Morshed Alam, Mohammad Fakrul Alam . A Practical Approach and Mitigation Techniques on Application Layer DDoS Attack in Web Server. International Journal of Computer Applications. 131, 1 ( December 2015), 13-20. DOI=10.5120/ijca2015907209
Abstract
Denial of Service (DoS) or Distributed Denial of Service (DDoS) is a powerful attack which prevents the system from providing services to its legitimate users. Several approaches exist to filter network-level attacks, but application-level attacks are harder to detect at the host base firewall. Filtering in application level can be computationally expensive and difficult to scale, while DDoS attacks still creating bogus positives that block legitimate users. In this paper, the authors show application layer DoS attack for HTTP web server using some open source DoS attack tools and also suggest some realistic mechanisms that can protect a web server from application-level DoS attacks especially while attacks targeting the resources including CPU, sockets, memory of the victim server. The authors propose a new DDoS defense mechanism that protects http web servers from application-level DDoS attacks based on the reverse proxy. The attack flow detection mechanism detects attack flows based on the symptom or stress at the server, since it is getting more difficult to identify bad flows only based on the incoming traffic patterns. A popular software known as Wireshark which is a network protocol analyzer is used to capture the packets during a DoS attack from the victim server Ethernet interface to detect the attacking host IP address and analysis the types of attack. We evaluate the performance of the proposed scheme via experiment.
References
- D. Dagon, G. Gu, C. P. Lee, W. Lee, “A Taxonomy of Botnet Structures,” in Proc. of Annual Computer Security Applications Conference (ACSAC), Dec. 2007.
- www.arbornetworks.com
- T. Peng, C. Leckie, K. Ramamohanarao, “Survey of Network-Based Defense Mechanisms Countering the DoS and DDoS Problems,” ACM Computing Surveys, vol. 39, no. 1, pp. 1-42, Apr. 2007.
- S. Kandula, D. Katabi, M. Jacob, A. W. Berger, “Botz-4-sale: surviving organized DDoS attacks that mimic flash crowds,” in Proc. of NSDI, Boston, MA, 2005.
- C. Estan, G. Varghese, “New Directions in Traffic Measurement and Accounting,” in Proc. of ACM SIGCOMM, Aug. 2002.
- R.R. Kompella, S. Singh, G. Varghese, “On Scalable Attack Detection in the Network,” in Proc. of ACM Internet Measurement Conference (IMC), Oct. 2004.
- Jose Nazario, BlackEnergy DDoS Bot Analysis, Technical report, Arbor Networks, Oct. 2007.
- Z. Zhu, G. Lu, Y. Chen, Z. J. Fu, P. Roberts, K. Han, “Botnet Research Survey,” in Proc. of IEEE COMPSAC, pp. 967-972, 2008.
- ha.cker.org security lab, Slowloris HTTP DoS, http://ha.cker s.org/slowloris/
- J. Mirkovic, P. Reiher, “A taxonomy of DDoS attack and DDoS defense mechanisms,” SIGCOMM Computer Communication Review, vol. 34, no. 2, pp. 39-53, 2004.
- A. Kuzmanovic, E. Knightly, “Low-rate TCP-targeted denial of service attacks (the shrew vs. the mice and elephants),” in Proc. of ACM SIGCOMM, pp. 75-86, 2003.
- G.Macia-Fernandez, J.E.Diaz-Verdejo, P.Garcia-Teodoro, “Evaulation of a low-rate DoS attack against application servers,” Computers & Security, vol. 27, no. 7, pp. 335-354, 2009.
- H. Sun, J. Lui, D. Yau, “Defending against low-rate TCP attacks: dynamic detection and protection,” in Proc. of 12th IEEE International Conference on Network Protocols (ICNP04), pp. 196-205, 2004.
- W. Wei, Y. Dong, D. Lu, G. Jin, H. Lao, “A novel mechanism to defend against low-rate denial-of-service attacks,” Lecture Notes Comput. Sci. 3975,pp. 261-271, 2006.
- G. Macia-Fernandez, R. A. Rodriguez-Gomez, J. E. Diaz-Verdejo, “Defense techniques for low-rate DoS attacks against application servers,” Computer Networks, vol. 54, no. 15, pp. 2711-2727, 2010.
- M Srivatsa, A. Iyengar, J. Yin, “Mitigating application-level denial of service attacks on web servers: a client-transparent approach,” ACM Transactions on the Web, vol. 2, no. 3, pp. 15:1-15:49, July 2008.
- http://en.wikipedia.org/wiki/Reverse_proxy
- www.nginx.com
- Mohammad Fakrul Alam, "Application Layer DDoS, A Practical Approach & Mitigation Techniques, “South Asian network Operators Group (SANOG) -23 Conference, Thimpu, Bhutan, 2014.
Index Terms
Keywords