DDoSDetect: A Behavioral Detection System for HTTP GET Flood Attacks

Application layer Distributed Denial of Service (DDoS) attacks are becoming increasingly prevalent on Internet based web services. Severe HTTP GET flood attacks are often launched by attackers, wherein web servers become overwhelmed with superfluous GET requests. This exhausts the processing and connectivity resources of the servers, hence resulting in service failures. As availability of services is key to online service providers, this work presents a behavioral based detection system named 'DDoSDetect' for HTTP GET flood attacks. In DDoSDetect, a traffic monitor tracks incoming GET requests sent to the server. Four distinct behavioral features such as the rate of requests, time interval between successive requests, session rate and the frequency of requests on a web page, are employed to analyze user's behaviors. A detection unit driven by three phases: LRP (Legitimate Request Phase), IRP (Illegitimate Request Phase) and SVM-RC (Support Vector Machine-Request Classifier) is designed to intelligently classify incoming GET requests. Illegitimate GET requests are dropped while legitimate requests are forwarded to the web server. DDoSDetect is implemented and results obtained from evaluation processes signify the effectiveness of the system towards the mitigation of HTTP GET flood attacks. Also, the system is real time and capable of handling sophisticated attacks.