SGER: A New Approach for Identifying DoS Attackers Based on Group Testing Techniques

Internet安全中最关键的问题之一是拒绝服务（DoS）攻击，其目的是使合法客户端无法使用服务。在本项目中，我们考虑了一种复杂的攻击，称为服务级拒绝服务攻击，这种攻击很难识别，因为恶意请求可以任意与合法请求相似，并且可以绕过基于网络的防御系统。我们提出了一种新的框架来检测攻击者的基础上组测试（GT）技术，可以克服目前的检测方法的局限性。更具体地说，本项目旨在研究以下挑战：1）研究动态阈值模型，以处理每个服务器上的合法突发和客户端数量的变化; 2）合法和恶意请求是相似的，需要新的测试设计，而不是逐个检查每个请求或严格指定合法行为; 3）此外，对该模型的研究还引出了一种新的成组测试方法，即规模约束成组测试（SCGT），它需要对矩阵构造的复杂性进行深入分析。这种数学上严格的框架有助于最大限度地减少检测的假阳性和假阴性，这是目前任何现有防御机制的主要问题。

One of the most critical problems in Internet security is the Denial-of-Service (DoS) attack, which aims to make a service unavailable to legitimate clients. In this project, we consider a sophisticated attack, called service-level DoS attack, which is very difficult to identify as malicious requests can be made arbitrarily similar to legitimate ones and can bypass the network-based defense systems. We propose a novel framework to detect the attackers based on the group testing (GT) technique which can overcome the limitations of current detection approaches. More specifically, this project seeks to investigate the following challenges: 1) Dynamic threshold model is studied to handle the legitimate bursts and variance in the number of clients on each server; 2) Legitimates and malicious requests are similar, required new testing design without examining each request one by one or tightly specifying legitimate behaviors; 3) In addition, the study of the proposed model evokes a new type of GT, called Size Constraint Group Testing (SCGT) which requires an in depth analysis of matrix construction complexity. This mathematically rigorous framework helps to minimize the false positive and false negative of detection, which is the main problem currently for any existing defense mechanisms.