Sequence-order-independent network profiling for detecting application layer DDoS attacks

摘要: Distributed denial of service (DDoS) attacks, which are a major threat on the Internet, have recently become more sophisticated as result their ability to exploit application-layer vulnerabilities. Most defense methods designed for detecting DDoS attacks IP and TCP layers consequently difficulty in this new type attack. With profiling web browsing behavior, sequence order page requests can be used (App-DDoS) attacks. However, may harmful than helpful behaviors because it varies significantly different individuals behaviors. This article introduces sequence-order-independent method network traffic detection App-DDoS Four attributes extracted from request sequences without consideration requested pages. A model based multiple principal component analysis is proposed normal behaviors, its reconstruction error criterion The experimentally confirmed with various types