ConnectionScore: a statistical technique to resist application-layer DDoS attacks

摘要: In an application-layer distributed denial of service (DDoS) attack, zombie machines send a large number legitimate requests to the victim server. Since these have formats and are sent through normal TCP connections, intrusion detection systems cannot detect them. attacks, adversary does not saturate bandwidth server inbound traffic, but outbound traffic. The next aim is consume exhaust computational resources (e.g., CPU cycles), memory resources, TCP/IP stack, input/output devices, etc. This paper proposes novel scheme which called ConnectionScore resist such DDoS attacks. During attack time, any connection scored based on history statistical analysis has been done during condition. bottleneck retaken from those connections take lower scores. Our shows that established by give low fact, technique can estimate legitimacy with high probability. rate suspicious being dropped adjusted current level overload threshold-level free resources. To evaluate performance scheme, we perform experiments in Emulab environment using real traceroute data ClarkNet WWW ( http://ita.ee.lbl.gov/html/contrib/ClarkNet-HTTP.html ).