Mitigating application-level denial of service attacks on Web servers

摘要: Recently, we have seen increasing numbers of denial service (DoS) attacks against online services and Web applications either for extortion reasons or impairing even disabling the competition. These DoS increasingly targeted application level. Application-level emulate same request syntax network-level traffic characteristics as those legitimate clients, thereby making much harder to detect counter. Moreover, such often target bottleneck resources disk bandwidth, database CPU resources. In this article, propose handling by using a twofold mechanism. First, perform admission control limit number concurrent clients served service. Admission is based on port hiding that renders invisible unauthorized which accepts incoming requests. Second, congestion admitted allocate more good clients. Congestion achieved adaptively setting client's priority level in response requests way can incorporate application-level semantics. We present detailed evaluation proposed solution two sample applications: Apache HTTPD TPCW benchmark (running Tomcat IBM DB2). Our experiments show incurs low performance overhead resilient attacks.