Browsing behavior mimicking attacks on popular web sites for large botnets

Yu, S; Zhao, G; Guo, S; Yang, X; Vasilakos, AV

dc.contributor.author	Yu, S	en
dc.contributor.author	Zhao, G	en
dc.contributor.author	Guo, S	en
dc.contributor.author	Yang, X	en
dc.contributor.author	Vasilakos, AV	en
dc.date.accessioned	2014-03-01T02:47:17Z
dc.date.available	2014-03-01T02:47:17Z
dc.date.issued	2011	en
dc.identifier.uri	https://dspace.lib.ntua.gr/xmlui/handle/123456789/33060
dc.subject	attack simulation	en
dc.subject	botnet	en
dc.subject	browsing behavior	en
dc.subject.other	Application layers	en
dc.subject.other	attack simulation	en
dc.subject.other	Attack traffic	en
dc.subject.other	botnet	en
dc.subject.other	Botnets	en
dc.subject.other	Browsing behavior	en
dc.subject.other	DDoS Attack	en
dc.subject.other	Detection algorithm	en
dc.subject.other	False negative rate	en
dc.subject.other	False negatives	en
dc.subject.other	Intrusion Detection Systems	en
dc.subject.other	Inverse Gaussian distribution	en
dc.subject.other	Markov model	en
dc.subject.other	Novel applications	en
dc.subject.other	Pareto distributions	en
dc.subject.other	Real traffic	en
dc.subject.other	Statistical distribution	en
dc.subject.other	Time interval	en
dc.subject.other	Web page	en
dc.subject.other	Zipf-like distribution	en
dc.subject.other	Computer simulation	en
dc.subject.other	Intrusion detection	en
dc.subject.other	Markov processes	en
dc.subject.other	User interfaces	en
dc.subject.other	Websites	en
dc.subject.other	Behavioral research	en
dc.title	Browsing behavior mimicking attacks on popular web sites for large botnets	en
heal.type	conferenceItem	en
heal.identifier.primary	10.1109/INFCOMW.2011.5928949	en
heal.identifier.secondary	http://dx.doi.org/10.1109/INFCOMW.2011.5928949	en
heal.identifier.secondary	5928949	en
heal.publicationDate	2011	en
heal.abstract	With the significant growth of botnets, application layer DDoS attacks are much easier to launch using large botnet, and false negative is always a problem for intrusion detection systems in real practice. In this paper, we propose a novel application layer DDoS attack tool, which mimics human browsing behavior following three statistical distributions, the Zipf-like distribution for web page popularity, the Pareto distribution for page request time interval for an individual browser, and the inverse Gaussian distribution for length of browsing path. A Markov model is established for individual bot to generate attack request traffic. Our experiments indicated that the attack traffic that generated by the proposed tool is pretty similar to the real traffic. As a result, the current statistics based detection algorithms will result high false negative rate in general. In order to counter this kind of attacks, we discussed a few preliminary solutions at the end of this paper. © 2011 IEEE.	en
heal.journalName	2011 IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS 2011	en
dc.identifier.doi	10.1109/INFCOMW.2011.5928949	en
dc.identifier.spage	947	en
dc.identifier.epage	951	en