Advanced SearchSearch Tips
Detecting the HTTP-GET Flood Attacks Based on the Access Behavior of Inline Objects in a Web-page Using NetFlow Data
facebook(new window)  Pirnt(new window) E-mail(new window) Excel Download
 Title & Authors
Detecting the HTTP-GET Flood Attacks Based on the Access Behavior of Inline Objects in a Web-page Using NetFlow Data
Kang, Koo-Hong;
  PDF(new window)
Nowadays, distributed denial of service (DDoS) attacks on web sites reward attackers financially or politically because our daily lifes tightly depends on web services such as on-line banking, e-mail, and e-commerce. One of DDoS attacks to web servers is called HTTP-GET flood attack which is becoming more serious. Most existing techniques are running on the application layer because these attack packets use legitimate network protocols and HTTP payloads; that is, network-level intrusion detection systems cannot distinguish legitimate HTTP-GET requests and malicious requests. In this paper, we propose a practical detection technique against HTTP-GET flood attacks, based on the access behavior of inline objects in a webpage using NetFlow data. In particular, our proposed scheme is working on the network layer without any application-specific deep packet inspections. We implement the proposed detection technique and evaluate the ability of attack detection on a simple test environment using NetBot attacker. Moreover, we also show that our approach must be applicable to real field by showing the test profile captured on a well-known e-commerce site. The results show that our technique can detect the HTTP-GET flood attack effectively.
HTTP-GET flood attack;Internet security;NetFlow;
 Cited by
T. Yatagai, T. Isohara, and I. Sasase, "Detection of HTTP-GET flood Attack Based on Analysis of Page Access Behavior," Proceedings of IEEE Pacific Rim Conference, pp. 232-235, 2007.

D. Dittrich and F. Sven, "P2P as botnet command and control: a deeper insight," Proceedings of the 3rd International Conference on Malicious and Unwanted Software, pp. 41-48, 2008.

P. Chwalinkski, R. Belavkin, and X. Cheng, "Detection of Application Layer DDoS Attack with Clustering and Likelihood Analysis," Proceedings of Globecom, 2013.

AhnLab TrusGuard DPX,

Peakflow Threat Management System,

Introduction to Cisco IOS NetFlow,

B. Claise, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information," IETF working group, 2013.

B. Mah, "An Empirical Model of HTTP Network Traffic," Proceedings of INFOCOM'97, pp.592-600, 1997.

W. Lu and S. Yu, "An HTTP Flooding Detection Method Based on Browser Behavior," Proceedings of Computational Intelligence and Security, pp.1151-1154, 2006.

Y. Choi, I. Kim, J. Oh, and J. Jang, "AIGG Threshold Based HTTP GET Flooding Attack Detection," Proceedings of WISA, 2012.

M. Srivatsa, A. Iyengar, J. Yin, and L. Liu, "Mitigating application-level denial of service attacks on Web servers: A client-transparent approach," ACM Trans. on the Web, Vol. 2, No. 3, Article 15, July 2008.

C.M Chen, B.C Jeng, C.R. Yang, and G.H. Lai, "Tracing denial of service origin: Ant colony approach," Applications of Evolutionary Computing, Springer Berlin Heidelberg, pp.286-295, 2006.

X. Yin, W. Yurcik, M. Treaster, Y. Li, and K. Lakkaraju, "VisFlowConnect: netflow visualizations of link relationships for security situational awareness," Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, pp.26-34, 2004.

D. Huistra, "Detecting Reflection Attacks in DNS Flows," Proceedings of 19th Twente Student Conference on IT, 2013.

L. Bilge, D. Balzarotti, W. Robertson, E. Kirda, and C. Kruegel, "Disclosure: detecting botnet command and control servers through large-scale netflow analysis," Proceedings of the 28th Annual Computer Security Applications Conference, pp.129-138, 2012.

C. Estan, K. Keys, D. Moore, and G. Varghese, "Building a better NetFlow," ACM SIGCOMM Computer Communication Review, Vol. 34, No. 4, pp.245-256, 2004. crossref(new window)

H. Choi and J.O. Limb, "A Behavioral Model of Web Traffic," Proceedings of Seventh International Conference on Network Protocols, pp. 327-334, 1999.

S. Yu, G. Zhao, S. Guo, Y. Xiang, and A.V. Vasilakos, "Browsing Behavior Mimicking Attacks on Popular Web Sites for Large Botnets," Proceedings of IEEE INFOCOM WKSHPS, pp.947-951, 2011.

K.S. Han and E.G. Im, "A Study on the Analysis of Netbot and Design of Detection Framework," Proceedings of Joint Workshop on Information Security, pp.1-12, 2009.

Cisco, Cisco Catalyst 3750-X and 3560-X Series Switches Data Sheet, tches/catalyst-3750-x-series-switches/data_sheet_c78-584733.html

endace, EndaceFlow NetFlow Generator Appliances,