Journal Homepage: www.ijcst.org

Abstract—In this paper, a lightweight mechanism is proposed to mitigate session flooding and request flooding app-DDoS attacks on web servers. App-DDoS attack is Application layer Distributed Denial of Service attack. This attack prevents legitimate users from accessing services. Numbers of mechanisms are available and can be installed on routers and firewalls to mitigate network layer DDoS attacks like SYN-flood attack, ping of death attack. But Network layer solution is not applicable because App-DDoS attacks are indistinguishable based on packets and protocols. A lightweight mechanism is proposed which uses trust to differentiate legitimate users and attackers. Trust to client is evaluated based on his visiting history and requests are scheduled in decreasing order of trust. In this mechanism trust information is stored at client side in the form of cookies. This mitigation mechanism can be implemented as a java package which can run separately and forward valid requests to server. This mechanism also mitigates request flooding attacks by using Client Puzzle Protocol. When server is under request flooding attack source throttling is done by imposing cost on client. Cost is collected in terms of CPU cycles