论文标题
延迟有危险的结束：慢速HTTP/2 DOS攻击野外及其实时检测，使用事件序列分析
Delays have Dangerous Ends: Slow HTTP/2 DoS attacks into the Wild and their Real-Time Detection using Event Sequence Analysis
论文作者
论文摘要
乔恩·波斯特尔（Jon Postel）在TCP实施的早期版本中撰写的鲁棒性原则指出，在接受数据时，通信实体应该是自由的。互联网上的几个实体确实遵循这一原则。例如，在这项工作中，我们表明，许多流行的Web服务器在等待大量时间段以接收不完整的Web请求的剩余部分时，它们都是慷慨的。不幸的是，这种行为也使它们容易受到一类网络攻击的攻击，通常称为缓慢的速率DOS攻击。 HTTP/2是HTTP的最新版本，最近被发现容易受到这些攻击的影响。但是，尚未研究速度缓慢的HTTP/2 DOS攻击对Internet上真实Web服务器的影响。同样，据我们所知，尚无辩护计划可以实时检测对HTTP/2的缓慢速率攻击。为了弥合这些差距，我们首先测试Internet上支持Web服务器的HTTP/2的行为，以缓慢的HTTP/2 DOS攻击。随后，我们提出了一种实时检测这些攻击的方案。我们表明，提出的检测方案可以以高精度和边缘计算开销实时检测攻击。
The robustness principle, written by Jon Postel in an early version of TCP implementation, states that the communicating entities should be liberal while accepting the data. Several entities on the Internet do follow this principle. For instance, in this work, we show that many popular web servers on the Internet are generous as they wait for a substantial time period to receive the remaining portion of an incomplete web request. Unfortunately, this behavior also makes them vulnerable to a class of cyber attacks, commonly known as Slow Rate DoS attacks. HTTP/2, the recent version of HTTP, is recently found vulnerable to these attacks. However, the impact of Slow HTTP/2 DoS attacks on real web servers on the Internet has not been studied yet. Also, to the best of our knowledge, there is no defense scheme known to detect Slow Rate DoS attacks against HTTP/2 in real-time. To bridge these gaps, we first test the behavior of HTTP/2 supporting web servers on the Internet against Slow HTTP/2 DoS attacks. Subsequently, we propose a scheme to detect these attacks in real-time. We show that the proposed detection scheme can detect attacks in real-time with high accuracy and marginal computational overhead.
