Botz-4-sale: surviving organized DDoS attacks that mimic flash crowds

摘要: Recent denial of service attacks are mounted by professionals using Botnets tens thousands compromised machines. To circumvent detection, attackers increasingly moving away from bandwidth floods to that mimic the Web browsing behavior a large number clients, and target expensive higher-layer resources such as CPU, database disk bandwidth. The resulting hard defend against standard techniques, malicious requests differ legitimate ones in intent but not content.We present design implementation Kill-Bots, kernel extension protect servers DDoS masquerade flash crowds. Kill-Bots provides authentication graphical tests is different other systems use tests. First, uses an intermediate stage identify IP addresses ignore test, persistently bombard server with despite repeated failures at solving These machines bots because their congest server. Once these identified, blocks requests, turns off, allows access users who unable or unwilling solve Second, sends test checks client's answer without allowing unauthenticated clients sockets, TCBs, worker processes. Thus, it protects mechanism being DDoSed. Third, combines admission control. As result, improves performance, regardless whether overload caused true Flash Crowd.