Application-Layer DDoS in Enterprise Networks and in the Cloud: Comprehensive Detection and Mitigation

点击翻译按钮获取中文摘要

Attacks on data availability are commonly referred to as Denial of Service (DoS) attacks, with Distributed Denial of Service (DDoS) attacks being their most potent form. Nowadays, the means to carry out sophisticated and potent DDoS attacks are within easy reach of anyone with a computer and an Internet connection. Do-it-yourself simple-to-deploy DDoS attack tools can be obtained for only a few $100. Botnets-for-rent are also available for as little as $50 per one hour of rental time. Due to their great affordability combined with a significant damage potential, DDoS attacks have emerged as the weapon of choice for a number of different individual/groups, ranging from financially-motivated cyber criminals to politically-motivated ‘hacktivists’. Last year in the US alone an average of 28 DDoS attacks occurred every hour, with the average cost of 1 hour of DDoS-caused downtime estimated at $100,000. More than 40% of companies affected by DDoS have experienced consequent losses of over $1,000,000 (each). Application layer DDoS (AL-DDoS) is a relatively recently popularized and an extremely potent family of DDoS attacks. And while cyber-criminals are only learning how to use AL-DDoS to their full advantage, cyber-defenders already have hard time coping with the stealthiness and impact of these attacks. The long-term goal of the research outlined in this proposal is to advance the state of the art in the field of AL-DDoS, and make notable contributions towards the development of comprehensive techniques for AL-DDoS detection and mitigation. Specifically, by looking at some of the key emerging trends in the Internet, the research aims to study the impact of these trends on the way AL-DDoS attacks are conducted and defended against, and consequently propose solutions that are more effective and better attuned to the current and upcoming challenges of the networked world. The research will encompass the study of both, the traditional enterprise networks as well as the Cloud infrastructure, as there are some unique aspects of dealing with AL-DDoS in each of these environments. Some of the specific short-term goals of the proposed research include: study of bot-less AL-DDoS, study of AL-DDoS using bot anonymization, detection and mitigation of AL-DDoS in highly dynamic Web-domains, detection and mitigation of AL-DDoS in the future Internet of Things (IoT). We believe that the research outlined in this proposal is highly relevant and has a potential to produce significant impact on the state of the Internet security and beyond – in Canada as well as world-wide. We also believe that our general involvement with issues related to DDoS have already improved and will continue to strengthen the international reputation of Canadian-generated cybersecurity research.