A MODIFIED METHOD FOR DETECTING APPLIED-LEVEL DDOS ATTACKS ON WEB SERVER RESOURCES - Kravchuk, Arkadii; Pogorelov, Volodymyr (Ukrainian Information Security Research Journal, 2023)
The number of devices connected to the Internet is increasing every year, while DDoS attacks are becoming more frequent, causing downtime of the attacked system. The main challenge is to detect an attack in real time and identify its source. Application layer attacks are similar to client traffic in that they have a low request rate and use software vulnerabilities to drain computing resources. Moreover, HTTP is the most common protocol among application layer attacks, and existing methods are not characterized by both high accuracy and speed. An improved method for analyzing Internet traffic data to identify application-level DDoS attacks at the HTTP protocol level is proposed, which will have a shorter response time to intrusions than existing methods and an identical level of accuracy in detecting malicious traffic. The modified method is based on the calculation of information entropy with new attributes that characterize the application layer. We have found the parameters of HTTP requests, the analysis of which indicates low-rate DDoS attacks, and derived formulas for calculating their entropy. The proposed method makes it possible to increase the speed of identifying the sources of DDoS attacks on web servers, including those that use the HTTPS protocol, by the development of middleware for web frameworks. The structural and logical organization of the attack detection system is described. The proposed method based on the microservice architecture can improve the protection of web servers from DDoS attacks, since the identification time has decreased, and the accuracy has increased.