A Defense Method against Distributed Slow HTTP DoS Attack

Threat of Distributed Denial of Service (DDoS) attack, that attempts to make a machine or network resource unavailable is getting serious. A service provided for load testing was abused to perform a DDoS attack targeting online game company in September, 2014. Such services are bringing serious threat for most services on the Internet. Slow HTTP DoS attack is one of the DoS attack methods that targets HTTP servers. This method obstructs the service by saturating the connection pool with slow and many requests. It is known that Slow HTTP DoS attack by just one attacker can be prevented effectively by limiting the number of connections for each IP address. On the other hand, it is also known that it is difficult to defend from Slow HTTP DoS attack from multiple attackers (i.e. Distributed Slow HTTP DoS attack). The threat of DDoS attack is getting serious, so we need a effective defense method against Distributed Slow HTTP DoS attack. In this paper, we propose and evaluate a defense method against Distributed Slow HTTP DoS attack by disconnecting the attack connections selectively by focusing on the number of connections for each IP address and the duration time. We show in our research that our proposed defense method is effective against Distributed Slow HTTP DoS attack.