본문 바로가기
  • Home
Basic Search

Detecting the HTTP-GET Flood Attacks Based on the Access Behavior of Inline Objects in a Web-page Using NetFlow Data

  • Journal of The Korea Society of Computer and Information
  • Abbr : JKSCI
  • 2016, 21(7), pp.1-8
  • Publisher : The Korean Society Of Computer And Information
  • Research Area : Engineering > Computer Science

Koohong Kang 1

1서원대학교

Accredited

ABSTRACT

Nowadays, distributed denial of service (DDoS) attacks on web sites reward attackers financially or politically because our daily lifes tightly depends on web services such as on-line banking, e-mail, and e-commerce. One of DDoS attacks to web servers is called HTTP-GET flood attack which is becoming more serious. Most existing techniques are running on the application layer because these attack packets use legitimate network protocols and HTTP payloads; that is, network-level intrusion detection systems cannot distinguish legitimate HTTP-GET requests and malicious requests. In this paper, we propose a practical detection technique against HTTP-GET flood attacks, based on the access behavior of inline objects in a webpage using NetFlow data. In particular, our proposed scheme is working on the network layer without any application-specific deep packet inspections. We implement the proposed detection technique and evaluate the ability of attack detection on a simple test environment using NetBot attacker. Moreover, we also show that our approach must be applicable to real field by showing the test profile captured on a well-known e-commerce site. The results show that our technique can detect the HTTP-GET flood attack effectively.

Statistics

  • 231 Viewed
  • 78 Downloaded

Tools

Issue List

Citation status

* References for papers published after 2023 are currently being built.

Basic Search Advanced Search