Detection of Application-Level Distributed Denial-of-Service Attacks

Distribuirani napadi uskraćivanjem usluge sve do danas ostali su neriješeni sigurnosni problem. U posljednje vrijeme sve su popularniji napadi koji ciljaju aplikacijski sloj jer zahtijevaju puno manje pojasne širine za uspješan napad u usporedbi s napadima na mrežni sloj. Cilj ovog rada je objasniti zbog čega je detekcija takvih napada težak problem i zašto se neuronske mreže pokazuju dobrom metodom za detekciju. U tu svrhu simulirani su DDoS napadi s nekoliko dostupnih alata i razvijen je postupak kojim se promet generiran simulacijom napada miješa s legitimnim prometom. Implementiran je sustav za detekciju napada uz pomoć neuronske mreže i testiran nad stvarnim prometom.Distributed Denial-of-service attack (DDoS attack) is still an unresolved security issue. Recently, attacks targeting the application layer are becoming more and more popular because they require less bandwidth for a successful attack compared to attacks on the network layer. The aim of this paper is to explain why detection of Application Layer attacks is a hard problem and why neural networks show good performance as a detection method. Four different tools were used for DDoS attack simulation and a method of merging traffic generated by the simulation with legitimate traffic was developed. A DDoS detection system using the neural networks was implemented and tested on real traffic