A Review of Defense Against Slow HTTP Attack <s> F. Related Work <s> Denial of service (DoS) attacks evolved and consolidated as severe security threats to network servers, not only for internet service providers but also for governments. Earlier DoS attacks involved high-bandwidth flood-based approaches exploiting vulnerabilities of networking and transport protocol layers. Subsequently, distributed DoS attacks have been introduced amplifying not only the overall attack bandwidth but also the attack source, thus eluding simple counter measures based on source filtering. Current low bit-rate approaches, instead, exploit vulnerabilities of application layer protocols to accomplish DoS or DDoS attacks. Slow DoS attacks like, e.g., slowloris are particularly dangerous because they can bring down a well equipped server using small attacker’s bandwidth, hence they can effectively run on low performance hosts, such as routers, game consoles, or mobile phones. In this paper, we study slow DoS attacks, analysing in detail the current threats and presenting a proper definition and categorisation for such attacks. Hopefully, our work will provide a useful framework for the study of this field, for the analysis of network vulnerabilities, and for the proposal of innovative intrusion detection methodologies. <s> BIB001 </s> A Review of Defense Against Slow HTTP Attack <s> F. Related Work <s> The analysis of realization low-intensity HTTP-attacks was performed. Were described scenarios of Slowloris, Slow POST and Slow READ attack. Features of this type of attacks in comparison with low- ... <s> BIB002 </s> A Review of Defense Against Slow HTTP Attack <s> F. Related Work <s> The ideas and techniques of DoS (Denial of Service) and DDoS (Distributed DoS) Attack strategies become more effective and more complex. In this paper, we focus on a Slow Read DoS Attack which is one of the sophisticated DoS attack techniques. This technique prolongs time to read the response from the Web server, although an attacker sends a legitimate HTTP request. When an attacker sends many such legitimate requests, he can keep many open connections to Web server and eventually cause DoS situation. In this paper, we analyze the effectiveness of Slow Read DoS Attack using the virtual network environment. As the result, we can find that Slow Read DoS Attack by a single attacker can be prevented by adequate security settings of Web server and applying countermeasure such as ModSecurity. However, from the analysis of Slow Read DoS Attack technique, we can also find that these countermeasures are not effective against distributed Slow Read DoS Attack (Slow Read Distributed DoS Attack) which is proposed in this paper. <s> BIB003 </s> A Review of Defense Against Slow HTTP Attack <s> F. Related Work <s> Slow HTTP Denial of Service (DoS) is an application layer DoS attack in which large number of incomplete HTTP requests are sent. If number of such open connections in the server exhaust a preset threshold, server does not accept any new connections thus creating DoS. In this paper we make twofold contributions. We do an empirical study on different HTTP servers for their vulnerability against slow HTTP DoS attacks. Subsequently we propose a method to detect Slow HTTP Dos attack. The proposed detection system is an anomaly detection system which measures the Hellinger distance between two probability distributions generated in training and testing phases. In the training phase it creates a normal profile as a probability distribution comprising of complete and incomplete HTTP requests. In case of Slow HTTP attack the proportion of incomplete messages is increased in the overall traffic and detection system leverages this for detection by generating another probability distribution and finding difference between two probability distributions. We experiment by collecting data from a real web server and report the detection performance of proposed detection system. <s> BIB004 </s> A Review of Defense Against Slow HTTP Attack <s> F. Related Work <s> Threat of Distributed Denial of Service (DDoS) attack, that attempts to make a machine or network resource unavailable is getting serious. A service provided for load testing was abused to perform a DDoS attack targeting online game company in September, 2014. Such services are bringing serious threat for most services on the Internet. Slow HTTP DoS attack is one of the DoS attack methods that targets HTTP servers. This method obstructs the service by saturating the connection pool with slow and many requests. It is known that Slow HTTP DoS attack by just one attacker can be prevented effectively by limiting the number of connections for each IP address. On the other hand, it is also known that it is difficult to defend from Slow HTTP DoS attack from multiple attackers (i.e. Distributed Slow HTTP DoS attack). The threat of DDoS attack is getting serious, so we need a effective defense method against Distributed Slow HTTP DoS attack. In this paper, we propose and evaluate a defense method against Distributed Slow HTTP DoS attack by disconnecting the attack connections selectively by focusing on the number of connections for each IP address and the duration time. We show in our research that our proposed defense method is effective against Distributed Slow HTTP DoS attack. <s> BIB005 </s> A Review of Defense Against Slow HTTP Attack <s> F. Related Work <s> Slow Read DoS attack is a technique which interferes Web server by exhausting resources. There are no effective countermeasures against from this attack nowadays. In this paper, we analyze Slow Read DoS attack, we found that the efficient attack can be realized when the bandwidth is over 500[Kbps]. In addition, we found that attacker can more effective attack by setting the connection rate to be equal to the process capability of Web server. At the same time, we can derive the secure setting of Web server against Slow Read DoS attack. <s> BIB006
Risk of computer security threats by Slow HTTP attacks has triggered the network security experts to develop the defense techniques. Many different methods & techniques of defense are available for webserver. These methods vary depending on the protected object and the set of rules in operation. Researchers from academics have also done a lot of research to detect & deal with Slow HTTP attacks. A large amount of literature is available in these attacks. Here, we summarize models or methods that focus on dealing Slow HTTP attacks. Reference BIB004 proposed detection system is an anomaly detection system which measures the Hellinger Distance between two probability distributions generated in training and testing phases. Testing of proposed detection system by collecting simulated HTTP traffic on LAN and the Internet. Results show that proposed system detects Slow Header and Slow Message Body attacks with high accuracy. Reference BIB006 analyze Slow Read DoS attack. Results that the efficient attack can be realized when the bandwidth is over 500 Kbps. Also, the researcher found the secure setting of web server against Slow Read DoS attack. Reference BIB001 study slow DoS attacks, analysing in detail the current threats and presenting a proper definition and categorisation for such attacks. The research aimed to provide a useful framework for the study of this field, and for the proposal of innovative intrusion detection methodologies. Reference BIB003 analyzed the effectiveness of Slow Read DoS Attack by virtual network environment. The research concluded that attacking by a single attacker is not so efficient. A secure module for a web server, ModSecurity can limit the length of attack success status. Reference BIB005 propose and evaluate a defense method against Distributed Slow HTTP DoS attack by disconnecting the attack connections selectively by focusing on the number of connections for each IP address and the duration time. Reference  designed an attack tool, named SlowDroid. A tool runs on an Android mobile device. The research compares attacks with similar tools that already exist. The results that the tool designed is a serious threat. Reference BIB002 analysing web-server behaviour when various types of Slow HTTP-attack occurs using mathematical models. Analyse aimed at building the model for the systems for the types of Slow HTTP attacks detection.