Vulnerable Path Attack and its Detection = Vulnerable Path Attack and its Detection

다국어 초록 (Multilingual Abstract)

Application-layer Distributed Denial-of-Service (DDoS) attack is one of the leading security problems in the Internet. In recent years, the attack strategies of application-layer DDoS have rapidly developed. This paper introduces a new attack strategy named Path Vulnerabilities-Based (PVB) attack. In this attack strategy, an attacker first analyzes the contents of web pages and subsequently measures the actual response time of each webpage to build a web-resource-weighted-directed graph. The attacker uses a Top M Longest Path algorithm to find M DDoS vulnerable paths that consume considerable resources when sequentially accessing the pages following any of those paths. A detection mechanism for such attack is also proposed and discussed. A finite-state machine is used to model the dynamical processes for the state of the user`s session and monitor the PVB attacks. Numerical results based on real-traffic simulations reveal the efficiency of the attack strategy and the detection mechanism.

참고문헌 (Reference)

1 H.S.Kang, "sShield: small DDoS defense system using RIP-based traffic deflection in autonomous system" 67 (67): 820-836, 2014

2 M.K Yoon, "Using Whitelisting to Mitigate DDoS Attacks on Critical Internet Sites" 48 (48): 110-115, 2010

3 N.A. Mohammed, "Uniform DoS traceback" 45 (45): 17-26, 2014

4 K. Ioannidou, "The longest path problem has a polynomial solution on interval graphs" 61 (61): 320-341, 2011

5 H. Beitollahi, "Tackling Application-layer DDoS Attacks" 10 (10): 432-441, 2012

6 I.C. Paschalidis, "Spatio-Temporal Network Anomaly Detection by Assessing Deviations of Empirical Measures" 17 (17): 685-697, 2009

7 V. Durcekova, "Sophisticated Denial of Service attacks aimed at application layer" ELEKTRO 55-60, 2012

8 S.N. Shiaeles, "Real time DDoS detection using fuzzy estimators" 31 (31): 782-790, 2012

9 A. Ramamoorthi, "Real Time Detection and Classification of DDoS Attacks using Enhanced SVM with String Kernels" ICRTIT 91-96, 2011

10 C.Y. Chou, "Proactive Surge Protection: A Defense Mechanism for Bandwidth-Based Attacks" 17 (17): 1711-1723, 2009

11 S. McGregory, "Preparing for the next DDoS attack" 2013 (2013): 5-6, 2013

12 Y. Xie, "Monitoring the application-layer DDoS attacks for popular website" 17 (17): 15-25, 2009

13 SpiderLabs, "ModSecutity"

14 Y.Xiang, "Low-Rate DDoS Attacks Detection and Traceback by Using New Information Metrics" 6 (6): 426-437, 2011

15 D. Hayes, "Improving HTTP performance using `stateless’ TCP" 57-62, 2011

16 A. Alvarez-Alvarez, "Human Gait Modeling Using a Genetic Fuzzy Finite State Machine" 20 (20): 205-223, 2012

17 C. Cattani, "Harmonic Wavelet Approximation of Random, Fractal and High Frequency Signals" 43 (43): 207-217, 2010

18 J. Jung, "Flash crowds and denial of service attacks: Characterization and implications for CDNs and websites" ACM 293-304, 2002

19 D. Gavrilis, "Flash Crowd Detection Using Decoy Hyperlinks" 466-470, 2007

20 남승엽, "Defending HTTP Web Servers against DDoS Attacks through Busy Period-based Attack Flow Detection" 한국인터넷정보학회 8 (8): 2512-2531, 2014

21 A. Raghunath, "Data rate based adaptive thread assignment solution for combating the SlowPOST denial of service attack" 38 (38): 1-5, 2013

22 S. Ranjan, "DDoS-Shield: DDoS-Resilient Scheduling to Counter Application Layer Attacks" 17 (17): 26-39, 2009

23 K. Sourav, "DDoS detection and defense: client termination approach" 749-752, 2012

24 J. Nazario, "DDoS attack evolution" 2008 (2008): 7-10, 2008

25 F. Simmross-Wattenberg, "Anomaly Detection in Network Traffic Based on Statistical Inference and α-Stable Modeling" 8 (8): 494-509, 2011