A Model to Limit Batching Denial of Service Attacks on GraphQL

GraphQL is a dynamic API data query and manipulation language created by Facebook and made open source in 2015. A standout feature of GraphQL is batching, which allows multiple queries of varying complexity to be combined into a single query request. However, this feature makes GraphQL vulnerable to denial-of-service attacks. This paper aims to limit the effect of DoS attacks through a hybrid static/dynamic query cost analysis approach. Cost analysis involves calculating the cost of a query before or during execution. A model is developed and aims to combine the strengths of both static and dynamic query cost analysis to limit the effect of batching DoS attacks on APIs. A series of experiments were conducted using a prototype, and the overall evaluation of the experiments indicated that the prototype performs well in execution time and memory usage of queries, as well as in the accuracy of determining query cost.