Automation of Layer 7 DDoS Attacks and Post Forensic Analysis of Server Logs
Barry Hamilton · 2015
Application layer (L7) Distributed Denial of Service attacks are becoming more common and an emerging threat to legitimate sites. The goal of these attacks is to prevent legitimate users from accessing a website. Due to the nature of the attacks, the low rate, and the sophisticated imitation of user behavior from automated bots, it is difficult to diagnose these on time. There is an evolving 'industry' of blackmailing and using these attacks for illegal profit [1]. Even though L7 DDoS attacks are a serious threat, studying and experimenting with them is challenging. Organizations do not share server logs because of privacy concerns. Furthermore, implementing these attacks requires instrumentation and real testbeds in order to produce realistic attacks for analysis. Therefore, it is difficult to evaluate mitigation and detection techniques. Our contribution is twofold. First, we have developed a set of testbeds on the GENI (Global Environment for Network Infrastructure) cloud infrastructure [2] to facilitate research and development of detection and mitigation techniques of L7 DDoS attacks. Second, we have used a library of attacks to perform post forensic analysis and classify L7 DDoS attacks based on their individual characteristics. Our work automates and simplifies log generation of L7 DDoS attacks for research and experimentation, as well as provides criteria to detect abnormal requests using a library of attacks.