Detecting Http Flooding Attacks Based on Uniform Model

Abstract

The HTTP flooding attack is the most complicated type of DDoS attacks since the malicious packets are hidden in a huge amount of normal traffic. The present work introduce a new detection method for HTTP flooding attack according to the abnormal HTTP traffic behavior during attack time. The new scheme first keeps various statistical measurements for normal traffic attributes (e.g Request, Responses, Open connections, TCP packets, UDP packets and ICMP packets) as a reference profile. Then, the Mahalanobis distance between the reference profile and the statistical measurements of the incoming HTTP connection (i.e for every attribute) is computed during each interval of detection time. Finally, the detection decision is based on the probability of the uniform distribution. Two real traffic traces are used in our simulation to evaluate the detection efficiency of the proposed scheme by computing its detection rate and the probability of false positive and also false negative.