Slow DoS attacks: definition and categorisation. (1st January 2013)

• Record Type: Journal Article
• Authors: Cambiaso, Enrico; Papaleo, Gianluca; Chiola, Giovanni; Aiello, Maurizio
• Is Part Of: International journal on trust management in computing and communications. Volume 1:Number 3/4(2013)
• Page Start: 300
• Page End: 319
• Publication Date: 2013-01-01
• Subjects: network server security -- denial of service attacks -- flooding versus low bit-rate -- slow DoS attacks -- SDAs -- categorisation -- taxonomy; Data protection -- Periodicals; Database management -- Periodicals; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.8
• Languages: English
• ISSNs: 2048-8378

Abstract

Denial of service (DoS) attacks evolved and consolidated as severe security threats to network servers, not only for internet service providers but also for governments. Earlier DoS attacks involved high-bandwidth flood -based approaches exploiting vulnerabilities of networking and transport protocol layers. Subsequently, distributed DoS attacks have been introduced amplifying not only the overall attack bandwidth but also the attack source, thus eluding simple counter measures based on source filtering. Current low bit-rate approaches, instead, exploit vulnerabilities of application layer protocols to accomplish DoS or DDoS attacks. Slow DoS attacks like, e.g., slowloris are particularly dangerous because they can bring down a well equipped server using small attacker's bandwidth, hence they can effectively run on low performance hosts, such as routers, game consoles, or mobile phones. In this paper, we study slow DoS attacks, analysing in detail the current threats and presenting a proper definition and categorisation for such attacks. Hopefully, our work will provide a useful framework for the study of this field, for the analysis of network vulnerabilities, and for the proposal of innovative intrusion detection methodologies.