Detect Web Denial of Service Attacks Using Entropy and Support Vector Machine Algorithm

Document Type : Original Article

Authors

Abstract

By expanding Internet-based services and developing websites, cyber threats are also increasing. One of these threats is to perform denial-of-service attacks and interfere with the services of a website. Web or  application-layer service blocking attacks by creation of artificial traffic impose a heavy traffic on the web server and thus disrupt the Web service. In this research, to detect these attacks, Web server logs are     classified by applying 20 second time windows and calculating the activity level and the entropy of different IPs in each time window. Using entropy variance, time windows with continuity are determined. In the next stage, through the backup machine algorithm, the network is trained to store abnormal time windows, and ultimately IP addresses that lead to blocked service attacks or service disruptions are classified and       labelled. The proposed model was implemented on the EPA-HTTP standard dataset indicating improvement compared to previous studies.
 

Keywords

References

[1]     S.T. Zargar, J. Joshi, and D. Tipper, “A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks,” IEEE communications surveys & tutorials, vol. 15, no. 4, pp. 2046-2069, 2013.##
[2]     V. Kumar and K. Kumar, “Classification of DDoS attack tools and its handling techniques and strategy at application layer. In Advances in Computing, Communication, & Automation (ICACCA) (fall),” International Conference on, IEEE, pp. 1-6, 2016.##
[3]     “OWASP Top 10 -The Ten Most Critical Web Application Security Risks,” 2017.  www.OWASP.org.##
[4]     H. Akbari and Safavi Homami, “Provide a framework for estimating the status of distributed denial-of-service attacks by integrating information about human-technical sensors based on fuzzy logic,” Electronic and Cyber Defense Magazine, Number 3, 1396. (In Persian)##
[5]     S. Chawla, M. Sachdeva, and S. Behal, “Discrimination of DDoS attacks and Flash Events using Pearson’s Product Moment Correlation Method,” International Journal of Computer Science and Information Security, vol. 14, no. 10, p. 382, 2016.##
[6]     T. Subbulakshmi, “A learning-based hybrid framework for detection and defence of DDoS attacks,” International Journal of Internet Protocol Technology, vol. 10, no. 1, pp. 51-60, 2017.##
 [7]     J. Singh, K. Thongam, and T. De, “Entropy-Based Application Layer DDoS Attack Detection Using Artificial Neural Networks. Entropy,” vol. 18, no. 10, p. 350, 2016.##
[8]     E. Adi, Z. Baig, and P. Hingston, “Stealthy Denial of Service (DoS) attack modelling and detection for HTTP/2 services,” Journal of Network and Computer Applications, vol. 91, pp. 1-13, 2017.##
[9]     M. Mahanani, M. Jalali, and H. Namvar, “Classification and Identification of Day zero Attack Traffic Intrusion Detection Systems using TWSVM, FCM,” Third National Conference on Modern Approaches to Computer and Electrical Engineering, Rudsar, Azad University Islamic Unit of Rudsar and Amlash - Youth and Elite Researchers Club of RudsarAmlash, 1396. (In Persian)##
[10]   K. Dadashtabar ­Ahmadi and A. Jabbar Rashidi, “Detection of advanced cyber attacks using behavioral modeling, Benevolent, coral,” Fourth International Conference on Knowledge Based Research in Computer Engineering and Information Technology, Tehran, University of Abrar, 1396. (In Persian)##
[11]   M. Kantardzic, “Data Mining: Concepts, Models, Methods, and Algorithms,” John Wiley & Sons, 2011.##
[12]   M. V.Nidhi and K. M. Prasad, “Detection of Anomaly Based Application Layer DDos Attacks Using Machine Learning Approaches,” i-Manager’s Journal on Computer Science, vol. 4, no. 2, p. 6, 2016.##

Files

History

  • Receive Date: 23 December 2017
  • Accept Date: 27 May 2018
  • Publish Date: 20 February 2019

Share

How to cite

Statistics