SGER: A New Approach for Identifying DoS Attackers Based on Group Testing Techniques

互联网安全中最关键的问题之一是拒绝服务（DoS）攻击，其目的是使合法客户端无法使用服务。在这个项目中，我们考虑一种复杂的攻击，称为服务级DoS攻击，这种攻击很难识别，因为恶意请求可以任意地发出与合法请求相似的请求，并且可以绕过基于网络的防御系统。提出了一种基于组测试（GT）技术的攻击检测框架，克服了现有检测方法的局限性。更具体地说，该项目旨在研究以下挑战：1)研究动态阈值模型来处理合法突发和每个服务器上客户端数量的变化；2)合法请求和恶意请求相似，需要新的测试设计，而不需要逐个检查每个请求或严格指定合法行为；3)此外，该模型的研究引发了一种新型的GT，称为尺寸约束组测试（SCGT），它需要深入分析矩阵构造的复杂性。这个数学上严谨的框架有助于最大限度地减少检测的假阳性和假阴性，这是目前任何现有防御机制的主要问题。

One of the most critical problems in Internet security is the Denial-of-Service (DoS) attack, which aims to make a service unavailable to legitimate clients. In this project, we consider a sophisticated attack, called service-level DoS attack, which is very difficult to identify as malicious requests can be made arbitrarily similar to legitimate ones and can bypass the network-based defense systems. We propose a novel framework to detect the attackers based on the group testing (GT) technique which can overcome the limitations of current detection approaches. More specifically, this project seeks to investigate the following challenges: 1) Dynamic threshold model is studied to handle the legitimate bursts and variance in the number of clients on each server; 2) Legitimates and malicious requests are similar, required new testing design without examining each request one by one or tightly specifying legitimate behaviors; 3) In addition, the study of the proposed model evokes a new type of GT, called Size Constraint Group Testing (SCGT) which requires an in depth analysis of matrix construction complexity. This mathematically rigorous framework helps to minimize the false positive and false negative of detection, which is the main problem currently for any existing defense mechanisms.