TWC: Option: Small: FRADE: Model Human Behavior for Flash cRowd Attack DEfense

应用程序级攻击，又称"闪存DDoS“攻击，是分布式拒绝服务（DDoS）最具挑战性的形式。他们向受害者提供大量机器人产生的合法服务请求。目前还没有任何防御措施可以有效地抵御Flash DDoS攻击，因此此类攻击对任何服务器都是严重的威胁。我们的项目致力于开发针对Flash DDoS攻击的防御措施，可以精确定位自动机器人发送的流量，并将其与人类生成的流量区分开来。然后，Bot IP被列入黑名单，其流量被过滤，保护服务器免受攻击，而不会对合法用户造成任何损害。我们的项目开发了一种名为ASTUTE（被动图灵测试）的新技术，通过对人类用户行为的三个方面进行建模来区分机器人和人类用户：（1）人类-服务器交互的动态，（2）人类对服务器内容的偏好，以及（3）人类对视觉和文本线索的处理。检测到的僵尸程序的IP地址将被列入黑名单，其流量将在服务器过载期间被丢弃。ASTUTE技术在没有人类有意识参与的情况下对人类行为进行建模，从而对人类透明地执行图灵测试（人类与机器的区分）。 我们将把所有代码实现为流行的开源服务器平台的扩展，比如Apache（用于Web）和bind（用于DNS）。在这项工作的最后，我们将提供这些扩展的工作原型，因此我们的研究将直接过渡到实践中，为任何有兴趣的一方，他们没有成本。我们所有的代码都将在GNU GPL v3许可下作为开源发布。

Application-level, aka ``flash-DDoS'' attacks are the most challenging form of distributed denial of service (DDoS). They flood the victim with legitimate-like service requests generated from numerous bots. There is no defense today that is even remotely effective against flash-DDoS attacks, thus such attacks are today a serious and unmitigated threat to any server. Our project works on developing defenses against flash-DDoS attacks that can pinpoint traffic sent by automated bots and differentiate it from human-generated traffic. Bot IPs are then blacklisted and their traffic filtered protecting the server under attack without any damage to legitimate users. Our project develops novel technologies called ASTUTE (pASsive TUring TEsts) to distinguish bots from human users, by modeling three aspects of human user behavior: (1) dynamics of human-server interaction, (2) human preference for server content, and (3) human processing of visual and textual cues. IP addresses of detected bots will be blacklisted and their traffic will be dropped during server overload. ASTUTE technologies model human behavior without conscious human participation, thus performing Turing tests (human vs machine differentiation) transparently to humans. We will implement all our code as extensions of popular open-source server platforms, such as Apache (for Web) and bind (for DNS). At the end of this work we will deliver working prototypes of these extensions, thus our research will directly transition into practice for any interested party at no cost to them. All our code will be released as open-source under the GNU GPL v3 license.