The ISC International Journal of Information Security

Abstract Distributed Denial of Service (DDoS) attacks are of two kinds viz. high-rate DDoS (HRDDoS) attacks and low-rate DDoS (LRDDoS) attacks. A shrew attack is a LRDDoS attack that can prove to be more harmful than a HRDDoS attack since they are not easily noticeable and are stealthy. They cause TCP flows to attain near-zero throughput by sending attack pulses of very short bursts synchronized with the TCP retransmission timeout (RTO) value. Consequently, it compels the TCP packets to be dropped whenever it tries to retransmit again after the timeout. Thus, it may endanger the victim systems if not detected for a long time and reduce the overall quality of services without being noticed. In this paper, we perform the analysis of the network traffic based on a statistical approach where the deviation in the behavior of the flows is analyzed based on the packets sent during the normal and attack conditions. To do this, we determine the participation of a flow in congestion and its adherence to the legitimate TCP-compliant nature during attack conditions based on a priority determiner D. The shrew attack flows exhibit higher values of $D$ as they do not adhere to the TCP compliance and tend to contribute to more congestion to disrupt a server. This nature of attack flows enables us to filter them based on the values of $D$ and mitigate them by blocking these flows. The experimental results on various scenarios demonstrated high accuracy to substantiate the efficacy of the proposed method.

Abstract Distributed Denial of Service (DDoS) attacks have become a critical threat to the Web with the increase in web-based transactions and application services offered by the Internet. With the vast resources and techniques easily available to the attackers countering them has become more challenging. They are usually carried out at the network layer. Unlike traditional network-layer attacks, application-layer DDoS attacks can be more effective. It utilizes legitimate HTTP requests to inundate victim resources that are undetectable. Many methods exist in the literature to protect systems from IP and TCP layer DDoS attacks that do not work when encountering application-layer DDoS attacks. Most network-layer DDoS attacks are flooding attacks, but application-layer DDoS attacks can be flooding attacks or protocol-specific vulnerability attacks. Various protocol-specific vulnerability attacks cannot be detected by traditional detection methods as they are designed to detect flooding attacks. One such attack is the slowloris attack. It targets web servers by exploiting an HTTP protocol vulnerability. In this paper, we propose a slowloris attack detection based on an adaptive timeout-based approach that contains two modules: a suspect determination module and an attacker verification module. The determination module determines suspects and sends them to the verification module, which verifies a suspect as an attacker. We have designed a detection algorithm that detects an attacker's IP address before it consumes all the resources. The experimental results substantiate its efficacy with low false alarms and high detection accuracy.