Browsing behavior mimicking attacks on popular web sites for large botnets

Shui Yu, Guofeng Zhao, Song Guo, Xiang Yang, Athanasios V. Vasilakos

Research output: Chapter in book / Conference proceedingConference article published in proceeding or bookAcademic researchpeer-review

7 Citations (Scopus)

Abstract

With the significant growth of botnets, application layer DDoS attacks are much easier to launch using large botnet, and false negative is always a problem for intrusion detection systems in real practice. In this paper, we propose a novel application layer DDoS attack tool, which mimics human browsing behavior following three statistical distributions, the Zipf-like distribution for web page popularity, the Pareto distribution for page request time interval for an individual browser, and the inverse Gaussian distribution for length of browsing path. A Markov model is established for individual bot to generate attack request traffic. Our experiments indicated that the attack traffic that generated by the proposed tool is pretty similar to the real traffic. As a result, the current statistics based detection algorithms will result high false negative rate in general. In order to counter this kind of attacks, we discussed a few preliminary solutions at the end of this paper.
Original languageEnglish
Title of host publication2011 IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS 2011
Pages947-951
Number of pages5
DOIs
Publication statusPublished - 26 Jul 2011
Externally publishedYes
Event2011 IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS 2011 - Shanghai, China
Duration: 10 Apr 201115 Apr 2011

Conference

Conference2011 IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS 2011
Country/TerritoryChina
CityShanghai
Period10/04/1115/04/11

Keywords

  • attack simulation
  • botnet
  • browsing behavior

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Communication

Cite this