Detecting denial of service by modelling web-server behaviour

Computers and Electrical Engineering

Volumn 39, Issue 7, 2013, Pages 2252-2262

  Giralte, Luis Campo ^a   Conde, Cristina ^a   De Diego, Isaac Martin ^a   Cabello, Enrique ^a  

^a UNIVERSIDAD REY JUAN CARLOS   (Spain)

Author keywords

[No Author keywords available]

Indexed keywords

ACCESS TIME; DDOS ATTACK; DENIAL OF SERVICE; DISTRIBUTED DENIAL OF SERVICE; HTTP TRAFFIC; REAL TRAFFIC; TRAFFIC FLOW; WEB SERVERS;

NETWORK SECURITY; WEB SERVICES;

HTTP;

EID: 84885637369     PISSN: 00457906     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.compeleceng.2012.07.004     Document Type: Article

References (38)

1. Arbor networks. worldwide infraestructure security report. vol. 4., < http://www.arbornetworks.com/en/research.html >; 2012.
2. [Dns-operations] lots of queries for txt records?. < https://lists.dns-oarc.net/pipermail/dns-operations/2009-April/003779.html >; 2012.
3. Dns attack downs internet in parts of china. <://www.networkworld.com/ news/2009/052109-dns-attack-downs-internet-in.html >; 2012.
4. Slowloris http dos. < http://ha.ckers.org/slowloris/ >; 2012.
5. Mitigating slowloris. < http://www.cert.org/blogs/certcc/2009/07/ slowloris-vs-your-webserver.html >; 2012.
6. Slowloris and iranian ddos attacks. < http://isc.sans.edu/diary.html? storyid=6622 >; 2012.
7. The imddos botnet: Discovery and analysis. < http://www.damballa.com/ downloads/r-pubs/Damballa-Report-IMDDOS.pdf >; 2012.
8. Media temple network unavailability. < http://status.mediatemple.net/ weblog/category/system-incidents/1319-mt-media-temple-network-unavailability/ >; 2010.
9. Wikileaks using amazon servers after attack. < http://blogs.wsj.com/ digits/2010/11/29/wikileaks-using-amazon-servers-after-attack/ >; 2012.
10. Wikileaks and the failure of cyberattacks as censorship. < http://blogs.forbes.com/andygreenberg/2010/11/28/wikileaks-and-the-failure-of- cyberattacks-as-censorship/ >; 2012.
11. Operation payback attacks target mastercard and paypal sites to avenge wikileaks. http://thelede.blogs.nytimes.com/2010/12/08/operation-payback- targets-mastercard-and-paypal-sites-to-avenge-wikileaks/; 2012.
12. Operation payback. < http://en.wikipedia.org/wiki/Operation-Payback >; 2012.
13. Low orbit ion cannon. < http://sourceforge.net/projects/loic/ >; 2012.
14. Siege. < http://www.joedog.org/index/siege-home >; 2012.
15. D. Moore, C. Shannon, D.J. Brown, G.M. Voelker, and S. Savage Inferring internet denial-of-service activity ACM Trans Comput Sys 24 2 2006 115 139
16. R.F. Erbacher, A. Cutler, P. Banerjee, and J. Marshall A multi-layered approach to botnet detection H.R. Arabnia, S. Aissi, Security and Management 2008 CSREA Press 301 308
17. Y. Chen, K. Hwang, and W.-S. Ku Collaborative detection of ddos attacks over multiple network domains IEEE Trans Parallel Distrib Sys 18 12 2007 1649 1662
18. A. Lakhina, M. Crovella, and C. Diot Mining anomalies using traffic feature distributions SIGCOMM Comput Commun Rev 35 4 2005 217 228
19. K. Hwang, M. Cai, Y. Chen, and M. Qin Hybrid intrusion detection with weighted signature generation over anomalous internet episodes IEEE Trans Dependable Secur Comput 4 1 2007 41 55
20. X. Liu, X. Yang, and Y. Lu To filter or to authorize: network-layer dos defense against multimillion-node botnets SIGCOMM '08: Proceedings of the ACM SIGCOMM 2008 Conference on Data communication 2008 ACM New York, NY, USA 195 206
21. J. Mirkovic, A. Hussain, B. Wilson, S. Fahmy, P. Reiher, and R. Thomas Towards user-centric metrics for denial-of-service measurement ExpCS '07: Proceedings of the 2007 workshop on Experimental computer science 2007 ACM New York, NY, USA 8
22. Gavrilis D, Chatzis IS, Dermatas E. Detection of web denial-of-service attacks using decoy hyperlinks.
23. Seufert S, O'Brien D. Machine learning for automatic defence against distributed denial of service attacks. In: ICC, IEEE; 2007. p. 1217-22.
24. A. Chonka, J. Singh, and W. Zhou Chaos theory based detection against network mimicking ddos attacks Comm Lett 13 9 2009 717 719
25. L. Li, and G. Lee Ddos attack detection and wavelets Telecommun Sys 28 3-4 2005 435 451
26. N. Danner, D. Krizanc, and M. Liberatore Financial cryptography and data security 2009 Springer-Verlag Berlin, Heidelberg p. 273-284 [chapter detecting denial of service attacks in tor]
27. L. Wang, Q. Wu, and D.D. Luong Engaging edge networks in preventing and mitigating undesirable network traffic NPSEC '07: Proceedings of the 2007 3rd IEEE Workshop on Secure Network Protocols 2007 IEEE Computer Society Washington, DC, USA 1 6
28. Yatagai I, Sasase. Detection of http-get flood attack based on analysis of page access behavior. In: Proceedings IEEE Pacific RIM Conference on Communications, Computers, and Signal Processing, IEEE; 2007. p. 232-35.
29. C. Siaterlis, and V. Maglaris Detecting incoming and outgoing ddos attacks at the edge using a single set of network characteristics Proceedings of the 10th IEEE Symposium on Computers and Communications 2005 IEEE Computer Society Washington, DC, USA 469 475
30. C. Lampe, and E. Johnston Follow the (slash) dot: effects of feedback on new members in an online community M. Pendergast, K. Schmidt, G. Mark, M. Ackerman, GROUP 2005 ACM 11 20
31. Y. Xie, and S.-Z. Yu Monitoring the application-layer ddos attacks for popular websites IEEE/ACM Trans Netw 17 1 2009 15 25
32. Lin X, Quan L, Wu H. An automatic scheme to categorize user sessions in modern http traffic. In: GLOBECOM, IEEE; 2008. p. 1485-90.
33. Zhu Z, Mao Y, Shi W. Workload characterization of uncacheable http content. In: Proceedings of International Conference on Web Engineering, Munich, LNCS 3140. Springer; 2004. p. 391-39 [Caching over the Entire User-to-Data Path, 2003].
34. X. Luo Optimizing the pulsing denial-of-service attacks Proceedings of the 2005 International Conference on Dependable Systems and Networks, DSN '05 2005 IEEE Computer Society Washington, DC, USA 582 591
35. X. Luo, E.W.W. Chan, and R.K.C. Chang Detecting pulsing denial-of-service attacks with nondeterministic attack intervals EURASIP J Adv Signal Process 2009 2009 8:1 8:13
36. Dong K, Yang S, Wang S. Analysis of low-rate tcp dos attack against fast tcp. In: Intelligent Systems Design and Applications, in:ternational Conference on 2006;3:86-91.
37. Acunetix web application security, < http://www.acunetix.com/ >; 2012.
38. Google's official googlebot, < http://www.google.com/bot.html >; 2012.