TWC: Option: Small: FRADE: Model Human Behavior for Flash cRowd Attack DEfense

应用程序级攻击是最具挑战性的分布式拒绝服务(DDoS)形式。它们向受害者发送大量机器人生成的类似合法服务的请求。如今，没有一种防御措施能有效抵御闪存-DDoS攻击，因此此类攻击如今对任何服务器都是一种严重的、无法减轻的威胁。我们的项目致力于开发针对闪电DDoS攻击的防御系统，可以精确定位自动机器人发送的流量，并将其与人类生成的流量区分开来。然后，僵尸IP被列入黑名单，其流量被过滤，保护受到攻击的服务器，而不会对合法用户造成任何损害。我们的项目开发了名为ASTUTE(被动图灵测试)的新技术，通过对人类用户行为的三个方面进行建模：(1)人与服务器交互的动态，(2)人对服务器内容的偏好，以及(3)人对视觉和文本提示的处理，从而将机器人与人类用户区分开来。检测到的僵尸程序的IP地址将被列入黑名单，其流量将在服务器过载期间被丢弃。精明的技术在没有有意识的人类参与的情况下模拟人类的行为，因此对人类透明地执行图灵测试(人与机器的区分)。我们将把我们的所有代码作为流行的开源服务器平台的扩展来实现，比如Apache(用于Web)和BIND(用于DNS)。在这项工作结束时，我们将交付这些扩展的工作原型，因此我们的研究将直接过渡到任何感兴趣的各方的实践中，而不需要他们支付任何费用。我们所有的代码都将在GNU GPLv3许可下以开源形式发布。

Application-level, aka ``flash-DDoS'' attacks are the most challenging form of distributed denial of service (DDoS). They flood the victim with legitimate-like service requests generated from numerous bots. There is no defense today that is even remotely effective against flash-DDoS attacks, thus such attacks are today a serious and unmitigated threat to any server. Our project works on developing defenses against flash-DDoS attacks that can pinpoint traffic sent by automated bots and differentiate it from human-generated traffic. Bot IPs are then blacklisted and their traffic filtered protecting the server under attack without any damage to legitimate users. Our project develops novel technologies called ASTUTE (pASsive TUring TEsts) to distinguish bots from human users, by modeling three aspects of human user behavior: (1) dynamics of human-server interaction, (2) human preference for server content, and (3) human processing of visual and textual cues. IP addresses of detected bots will be blacklisted and their traffic will be dropped during server overload. ASTUTE technologies model human behavior without conscious human participation, thus performing Turing tests (human vs machine differentiation) transparently to humans. We will implement all our code as extensions of popular open-source server platforms, such as Apache (for Web) and bind (for DNS). At the end of this work we will deliver working prototypes of these extensions, thus our research will directly transition into practice for any interested party at no cost to them. All our code will be released as open-source under the GNU GPL v3 license.