Secure Double-Layered Defense against HTTP-DDoS Attacks

A major cyber-security concern to date for webservers are Distributed Denial of Service (DDoS) attacks. Previously we proposed a novel overlay-based method consisting of distributed network of public servers (PS) for preparation, and access nodes (AN) for actual communication. The AN's performance is evaluated under difficult to detect HTTP(S)-DDoS attacks. Yet, attackers may attempt service denial by attacking the PS instead. The focus in this paper is on mitigating complex slow-requesting HTTP-DDoS attacks that target the PS. A proof-of-concept prototype is implemented with simplified countermeasures and tested. We report on the results of two experiments. Results suggest that the simple PS role can enable high mitigation factors of both high-rate and low-rate attack traffic per source, even with 10,000 unique attack sources per target PS, acting as a second layer of defense with the AN. Yet, with a cost of longer time to load the requested resource file in comparison to direct access.