Agile method for detecting DDoS attacks in the application layer based on user’s dynamism
Silvia Bravo, David Mauricio · International Journal of Engineering and Technology · 2018
DDoS attacks are one of the most damaging computer attacks of recent times.Attackers send large number of requests to saturate a victim machine and it stops providing its services to legitimate users.In general attacks are directed to the network layer and the application layer, the latter has been increasing due mainly to its easy execution and difficult detection.The present work proposes a low cost detection approach that consists of two steps: first, user characteristics are extracted in real time while browsing the web application; second, each extracted feature is used by an order sorter O(1) to differentiate a real user from a DDoS attack.A real user is identified by making requests using peripherals for navigation (user dynamism), while DDoS attacks are requests sent by robots and do not require the use of peripherals to make requests, therefore the characteristics of the user's dynamism are used for the detection of a DDoS attack.The results on the attack tests using the attack tools LOIC, OWASP and GoldenEye, show that the proposed method has a detection efficiency of 100%, and that the characteristics of the web user allow to differentiate between a real user and a robot.Keyword -Application layer, DDoS, user's dynamism, detection attacks, use of peripherals