Software defined network-based HTTP flooding attack defender. (July 2022)

• Record Type: Journal Article
• Authors: Mohammadi, Reza; Lal, Chhagan; Conti, Mauro; Sharma, Lokesh
• Is Part Of: Computers & electrical engineering. Volume 101(2022)
• Publication Date: 2022-07
• Subjects: HTTP flooding attack -- SDN -- Entropy -- Hellinger distance; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2022.108019
• Languages: English
• ISSNs: 0045-7906

Abstract

Abstract: In recent years, the explosive growth of the Internet has led to an increment in the number of Distributed Denial of Service (DDoS) attacks. HTTP Flooding is a critical DDoS attack that targets HTTP servers to prohibit users from receiving HTTP services. Moreover, it saturates the link bandwidth and consumes network resources. Because the attack is launched at the application layer, it is difficult to defend against it using current countermeasures such as firewall or Intrusion Prevention System (IPS). In this paper, we propose SHFD, which leverages the Software-Defined Networking (SDN) paradigm to mitigate HTTP flooding attacks. We implement SHFD as a defender module on the SDN controller to detect and mitigate the attack in the first place. Experimental results gathered from Mininet confirm that SHFD brings a significant improvement of 13% in detection time and 29% in the number of blocked malicious flows compared to the state-of-the-art approaches. Graphical abstract: Highlights: SHFD is proposed for mitigating slow and high rate HTTP flooding attacks in SDN-based networks. Shannon's Entropy and Hellinger distance methods are used in SHFD to provide more accurate results. Both slow/high rate HTTP flooding attack together with their side effects are explained in details.