A Robust Mechanism for Defending Distributed Denial OF Service Attacks on Web Servers

TL;DR

This paper introduces a new statistical detection mechanism to defend web servers against DDoS attacks by monitoring traffic and identifying abnormal patterns, aiming to improve current defense strategies.

Contribution

It proposes a robust, statistically-based detection algorithm that effectively identifies DDoS attacks, addressing limitations of existing defense mechanisms.

Findings

Effective detection of abnormal traffic rises

Simulation results show high accuracy in attack identification

Reduces false positives compared to previous methods

Abstract

Distributed Denial of Service (DDoS) attacks have emerged as a popular means of causing mass targeted service disruptions, often for extended periods of time. The relative ease and low costs of launching such attacks, supplemented by the current inadequate sate of any viable defense mechanism, have made them one of the top threats to the Internet community today. Since the increasing popularity of web-based applications has led to several critical services being provided over the Internet, it is imperative to monitor the network traffic so as to prevent malicious attackers from depleting the resources of the network and denying services to legitimate users. This paper first presents a brief discussion on some of the important types of DDoS attacks that currently exist and some existing mechanisms to combat these attacks. It then points out the major drawbacks of the currently existing defense mechanisms and proposes a new mechanism for protecting a web-server against a DDoS attack. In the proposed mechanism, incoming traffic to the server is continuously monitored and any abnormal rise in the inbound traffic is immediately detected. The detection algorithm is based on a statistical analysis of the inbound traffic on the server and a robust hypothesis testing framework. Simulations carried out on the proposed mechanism have produced results that demonstrate effectiveness of the proposed defense mechanism against DDoS attacks.