Identifying Slow HTTP DoS/DDoS Attacks against Web Servers DEPARTMENT ANDDepartment of Computer Science & Information SPECIALIZATIONTechnology, University of Engineering and Technology, Peshawar. MS Computer Science STUDENT NAMEArman Khan FATHER’S NAMEAbdurrahman CONTACT NO REGISTRATION NONA DATE OF REGISTRATIONFall 2013 RESEARCH SUPERVISORDr Syed Adeel Ali Sh ah

Introduction A Slow HTTP DDOS DOS attack is an attempt to make an server unavailable by overwhelming it with malicious client traffic from multiple sources

Background Cloud computing eases up the process of the scaling up businesses, especially in IT without investing a lot of money for infrastructure and training engineers. By using Cloud computing capabilities, we can expand the IT’s functionality with existing environments. Despite of all the benefits of using cloud still many enterprises and individuals are reluctant to run their business on the cloud. In February 2015 Anthem Inc, a leading health insurance company suffered a data breached that compromised information related to 80 million customers, Investigators detected that hackers could smuggle data out of cloud-based file sharing. In 2012 Dropbox which is cloud base storage had a data breach and had 68 million user accounts compromise. As you can see a famous company such as Dropbox and Anthem Inc have had huge data breaches so it reminds us security in cloud computing is not a negligible matter.

Background

Back…

Problem Statement There is no mechanism for automated evaluation of client-server applications to slow HTTP attacks. Slow http response attack Exploiting the content- length field of the http request which is used to specify the length of message body in bytes. Slow Read basically sends a legitimate HTTP request and then very slowly reads the response, thus keeping as many open connections as possible and eventually causing a DoS.

PURPOSE OF THE STUDY The primary purpose of the research study will be the identification of slow HTTP DoS/DDoS Attacks against Web Servers and provide effective counter-measures to address the issue.

Research Questions Which parameters of a slow HTTP should be considered in an algorithm? Is it possible to use the Local outlier identification cluster for anomaly detection? With the identified parameters for the LOCI algorithm, can we achieve lesser delays in communication?

Research Objectives The objective of this research is to design a mechanism to detect and address the issue of slow HTTP detects the Slow HTTP. A thorough analysis of Slow HTTP/DoS attack traffic is to be performed that is generated during client-server communication. By modelling this phase the detection of Slow HTTP DoS detection on Local Outlier Detection Mechanism (LOCI). A server is to be considered that accepts HTTP requests for connections and compromised systems that generate the attack.

EXPECTED CONTRIBUTION The expected contribution will be the identification of vulnerabilities and provide an effective mechanism against the slow’ HTTP DOS/DDOS’ attacks.

SIGNIFICANCE STATEMENTS The analysis of the direct impact of the slow-moving ‘HTTP header’, slow ‘HTTP DOS/DDOS’ attacks on a system/PC or VM will be tested in a client-server environment. The analysis will further evaluate the direct impact of the slow ‘HTTP DOS/DDOS’ header attacks on the neighbor's system/PC or VM, web server performance, Central Processing Unit (CPU) and Random-access memory (RAM) usage and network load will be closely monitored.

LITERATURE REVIEW Studying IDS is human dependent task requiring several hours, the most probable solution is anomaly based IDon Machine learning languages, to observer incoming packets to differentiate malicious and genuine packet, Machine learning techniques: Artificial Neural Network K Mean Clustering Fuzzy logic Genetic Algorithm Design Trees Support Vector Machine Naïve Bayes

RESEARCH METHODOLOGY : The lifecycle of a Slow HTTP attack will be analyzed and proposed which will be followed as below: Literature Review: This phase is based on recent work done for detection and analysis of Slow HTTP and DoS-for-hire service attacks. Design: This phase is constructed for the detection of Slow DDoS detection on Local Outlier Detection Mechanism (LOCI). A server is to be considered that accepts HTTP requests for connections and compromised systems that generate the attack

Implementation and Evaluation Java (to program the client-server) are to be used to implement the proposed detection scheme. The evaluation concludes that for the detection of Slow HTTP attacks the best features are related to ICMP packets statistics and client-server flow statistics. This phase will also test the performance of the proposed detection scheme along the axis of the selected metric such as response time/delay in detection.

Client 3 Client N Client 1 Client 2 Cloud SERVER Check whether the request is a slow http or normal. If slow, the client is malicious otherwise genuine Request Return status/ type of client If client type is malicious, then close connection /refuse request, otherwise Accept/ entertain LOCI Req. Res.

DATA COLLECTION The required data for the proposed approach is based on HTTP headers sent slowly by the client to the server in a traditional network environment. Malicious behavior of client depletes all resources of server resources. To test and monitor these packets client-server messages are to be closely analyzed in java program.

THANKS