Behaviour analysis of HTTP based slow denial of service attack

The technological advancement of computer network and popularity of Internet introduces many on-line services. As the services like e-governance, banking, e-commerce and trading etc. are becoming Internet based, the timely availability of these services to the users have gained paramount importance. Denial of Service (DoS) attack is one of the common attack used by the attacker to interrupt or block availability of the services to the genuine users. Recently, slow DoS attacks are getting popular among the attackers. Generally, the analysis of slow DoS attack is mainly based on the parameters derived from the host machine. In this paper, we analyze the network traffic pattern generated by four different types of slow DoS attack which is targeted on HTTP application. Our analysis focuses on the network based parameters such as window size and delta time of the packet which can be collected from the network gateway. By monitoring and analyzing these parameters, a host machine independent early detection of slow DoS attack is derived and preventive action can be initiated from the network gateway itself.