Detecting application layer DDoS attack using an advanced signature detection algorithm

Area of Science:

• Cybersecurity
• Network Security
• Applied Computer Science

Background:

• Application-layer Distributed Denial of Service (App-DDoS) attacks pose a significant threat by disrupting services through forged request headers.
• Existing detection methods struggle with identifying these forged headers, creating a critical research gap.

Purpose of the Study:

• To develop and evaluate a novel signature detection method for identifying forged request headers in App-DDoS attacks.
• To address the limitations of outdated attack patterns and lack of public datasets by using recent, representative data.

Main Methods:

• Analyzing network traffic request headers to categorize them as malicious or legitimate.
• Employing a hybrid feature selection method to identify key indicators of forged headers.
• Utilizing a recent, real-world dataset representative of current App-DDoS attack patterns.

Main Results:

• The signature detection method achieved high performance metrics: 96.93% accuracy, 99.11% precision, 97.55% recall, and 98.32% F1-score.
• The proposed detection algorithms successfully identify forged request headers at an early stage, before web server processing.
• The study confirmed that App-DDoS attack strategies rely on manipulating request headers.

Conclusions:

• Signature-based detection is effective and suitable for identifying App-DDoS attacks by analyzing request headers.
• The developed method offers a practical and accurate solution for real-world cybersecurity applications.
• This approach complements Machine Learning (ML) by effectively detecting attack signatures in request headers.