Abstract:Application‐layer distributed denial of service (DDoS) attacks have become the main threat to Web server security. Because application‐layer DDoS attacks have strong concealability and high authenticity, intrusion detection technologies that rely solely on judging client authenticity cannot accurately detect such attacks. In addition, application‐layer DDoS attacks are periodic and repetitive, and attack targets suddenly in a short period. In this study, we propose an efficient application‐layer DDoS detection system based on improved random forest. Firstly, the Web logs are preprocessed to extract the user session characteristics. Subsequently, we propose a Session Identification based on Separation and Aggregation (SISA) method to accurately capture user sessions. Lastly, we propose an improved random forest classification algorithm based on feature weighting to address the issue of an increasing number of features leading to prolonged calculation times in the random forest algorithm, and as the feature dimension increases, there might be instances where no subfeature is related to the category to be classified. More importantly, we compare the request source IP with the malicious IP in the threat intelligence library to deal with the periodicity and repetition of application‐layer DDoS attacks. We conducted a comprehensive experiment on the publicly available Web log dataset and the threat intelligence database of the laboratory as well as the simulated generated attack log dataset in the laboratory environment. The experimental results show that the proposed detection system can control the false alarm rate and false alarm rate within a reasonable range, improving the detection efficiency further, the detection rate is 99.85%. In secondary attack detection experiments, our proposed detection method achieves a higher detection rate in a shorter time.

Design and Implementation of a New Web Anti-Attack Method Based on URL Randomization

Design of Random Number Generation Algorithm

Adaptive IP Mutation: A Proactive Approach for Defending against Worm Propagation

Stochastic Stability Analysis of Networked Control Systems with Random Cryptographic Protection under Random Zero-Measurement Attacks

An Efficient Privacy-Preserving Scheme for Wireless Link Layer Security

Pseudo-randomness Inside Web Browsers

A New Data Randomization Method to Defend Buffer Overflow Attacks

A Unified and Fully Automated Framework for Wavelet-based Attacks on Random Delay

Defending against DoS attacks on 3G cellular networks via randomization method

Poster: A Pu Learning Based System For Potential Malicious Url Detection

Background Knowledge-Resistant Traffic Padding for Preserving User Privacy in Web-Based Applications

A Method Based on AMHI for DDoS Attacks Detection and Defense

Analysis and Application of the Techniques of Random Number in the Network Security

A Novel Method to Prevent Traffic Analysis in Low-Latency Anonymous Communication Systems

Efficient Based on Improved Random Forest Defense System Against Application‐Layer DDoS Attacks

Predicted Packet Padding for Anonymous Web Browsing Against Traffic Analysis Attacks

Novel Security Metrics for Identifying Risky Unified Resource Locators (URLs)

A Practical Website Fingerprinting Defense Approach with Universal Adversarial Perturbations.

RUDOLF: An Efficient and Adaptive Defense Approach Against Website Fingerprinting Attacks Based on Soft Actor-Critic Algorithm

De-randomizing the Code Segment with Timing Function Attack

A New Countermeasure for Protecting Authentication Protocols against Denial of Service Attack