Apache servers attacked by slowloris attack

Apache servers attacked by slowloris attack software#

Both of these attack variants are easily executed by attackers, and are difficult to detect as the resulting traffic is difficult to differentiate from normal HTTP communications. One such protocol with known exploits is the Hypertext Transfer Protocol (HTTP), which is often the target of attacks such as Slowloris and Slow POST DoS attacks. These attacks target specific application protocols being utilized by the target, many of which are prone to proven exploits.

In recent years, attackers have moved towards the implementation of application layer attacks, as these have proven harder to detect as opposed to traditional network layer based approaches. Although continued efforts are in effect to mitigate such attacks, attackers are constantly evolving their attack methodologies to avoid the newest detection techniques. According to the NETSCOUT Threat Intelligence Report for 2018, the overall number of DDoS attacks has increased by nearly 26% over the previous year.

Apache servers attacked by slowloris attack software#

Industry domains ranging from telecommunications to software publishing are finding themselves under constant bombardment from cyber attacks such as distributed denial of service (DDoS) attacks. Attackers are very much aware of the importance these applications hold for various companies, making them obvious targets for malicious exploits. Due to the growing reliance on such services, the security of the networks hosting these applications is more paramount than ever. In 2018, nearly 80% of enterprises have begun to experiment with apps running on cloud or network based platforms.

The continued rise of network and cloud-based applications allow for companies to provide robust and dynamic services to their customers across the world both cheaply and efficiently. Further, we determine through the use of significance testing, that the use of sampling techniques can significantly increase learner performance when detecting Slow HTTP DoS attack traffic. Our results show that the optimal learner and class distribution combination is that of Random Forest with a 65:35 distribution ratio, obtaining an AUC value of 0.99904. Five class distributions are generated to evaluate the Slow HTTP DoS detection performance of eight machine learning techniques. We also detail our process for collecting real-world representative Slow HTTP DoS attack traffic from a live network environment to create our datasets. In this work, we evaluate the use of data sampling to produce varying class distributions in order to counteract the effects of severely imbalanced Slow HTTP DoS big datasets. Machine learning techniques can be used to aid in detection, but the large level of imbalance between normal (majority) and attack (minority) instances can lead to inaccurate detection results. The issue, is that the number of legitimate traffic instances can far outnumber the amount of attack instances, making detection problematic. Successful mitigation of this attack type requires network analysts to evaluate large quantities of network traffic to identify and block intrusive traffic. Slow HTTP Denial of Service attacks are one such attack variant, which targets the HTTP protocol and can imitate legitimate user traffic in order to deny resources from a service. In recent years, attackers have begun to focus their attack efforts on the application layer, allowing them to produce attacks that can exploit known issues within specific application protocols. Attackers are consistently shifting to stealthier and more complex forms of attacks in an attempt to bypass known mitigation strategies. The integrity of modern network communications is constantly being challenged by more sophisticated intrusion techniques.