How Secure are Web Servers? An Empirical Study of Slow HTTP DoS Attacks and Detection

TLDR: This paper does an empirical study on different HTTP servers for their vulnerability against slow HTTP DoS attacks and proposes a method to detect Slow HTTP Dos attack, an anomaly detection system which measures the Hellinger distance between two probability distributions generated in training and testing phases.

Abstract: Slow HTTP Denial of Service (DoS) is an application layer DoS attack in which large number of incomplete HTTP requests are sent. If number of such open connections in the server exhaust a preset threshold, server does not accept any new connections thus creating DoS. In this paper we make twofold contributions. We do an empirical study on different HTTP servers for their vulnerability against slow HTTP DoS attacks. Subsequently we propose a method to detect Slow HTTP Dos attack. The proposed detection system is an anomaly detection system which measures the Hellinger distance between two probability distributions generated in training and testing phases. In the training phase it creates a normal profile as a probability distribution comprising of complete and incomplete HTTP requests. In case of Slow HTTP attack the proportion of incomplete messages is increased in the overall traffic and detection system leverages this for detection by generating another probability distribution and finding difference between two probability distributions. We experiment by collecting data from a real web server and report the detection performance of proposed detection system.