Application Layer Denial of Service Attack Mitigation by Traffic Queuing

Denial of Service (DoS) attacks pose a significant threat to any business, organization or an individual trying to create their presence on the internet. At times DoS attacks can become very hard to identify if they are being caused by a malicious source or just due to some palpable reasons like resource overconsumption due to a large number of real users trying to access the service. While one can increase the server resources like the compute power and bandwidth in order to continue serving the content to the users but scaling might not be the most efficient thing to do in every scenario. Many modern methods currently available makes it an hassle for the genuine user to access the resources during an overload or attack. And generally resulting in flagging of legit users too during an attack, making the overall experience not ideal. Traditional methods preventing DoS attacks relied on using rule/signature-based techniques which have their own limitations and can fail to detect most sophisticated and low-rate attacks. This paper proposes a system that leverages modern Machine Learning algorithms to analyze user behavior which can be extracted from server access logs. A supervised learning model is implemented which uses various features which are extracted from the Access Log file of a server to detect malicious traffic at the Application Layer. The results show a promising accuracy, precision and recall. This system can be deployed as an additional layer of defence with other pre-existing solutions to improve the system’s security.