Sequence-order-independent network profiling for detecting application layer DDoS attacks

3.1. Sequence-order-independent attributes

We represent each request sequence as a vector form of extracted attributes. Let us assume that N users browsed a web server where the total number of web pages is D. For user i who browsed this server, let s _i be the web page request sequence and η _{d, i} be the number of requests of user i for page d of the server. Then, is the total number of requests of user i and is the average number of requests of users.

Now, let us define several sequence-order-independent attributes for detecting App-DDoS attacks. To give a clearer representation of active user i, we introduce the attribute

(1)

which is the ratio of the number of requests of a user and their average value. The next attribute,

(2)

is the proportion of page d among pages requested by user i; it shows how much user i was interested in page d of the server.

To help determine whether incoming users are indicative of a DDoS attack, we supplement the two basic attributes with two other attributes that characterize the web browsing patterns of a user. The first supplementary attribute is defined as the proportion of all server pages requested by user i, i.e.,

(3)

where b _{d, i} is an indicator that equals 1 if η _{d, i} > and 0 otherwise. This attribute represents the breadth of user i's interest.

The next supplementary attribute shows the intensity of interest in the user's page of greatest interest. This attribute for user i can be defined by using q _i = argmax_d{η _{d, i} } to denote the most frequently requested page. Thus, the intensity of the user's interest in the page of greatest interest can be represented as follows by the ratio of the number of requests for the page of greatest interest and the number of page requests:

(4)

From these attributes, we denote a attribute vector as w _i = [h _i , α _i , τ _i , γ _i ]^T, where h _i = [h_1,i, h_2,i,...,h _D , _i ]^T. We then form the attribute matrix W = [w₁...w _N ].

3.2. PCA for web browsing behaviors

PCA is the simplest statistical method for transforming given data to new coordinates called principal components. By removing less important components, it can reduce the number of dimensions required to explain the given data. The reduced subspace best represents the given data in a least-squares sense.

We use PCA to model web browsing patterns; the modeling is based solely on normal users' attributes. To model the web browsing patterns, we first denote a mean vector, μ₀, and a covariance matrix, C, as , and C = XX^T/N, where X = [x _i ...x _N ], x _i = w _i - μ₀, and i = 1,...,N. We then compute the eigenvectors and eigenvalues by applying singular value decomposition to the covariance matrix.

If we let u _j be the j th most significant eigenvector of covariance matrix C, then the significant principal components are denoted by where P (≪ D) is the number of significant principal components. Since the remaining eigenvectors [u_P+1...u_D+3] are less significant, we can reduce the dimensions of the data without significant loss when these eigenvectors are discarded.

If the attribute vectors are projected into the subspace spanned by P significant principal components, then we can represent the attribute of web user i in terms of the following P-dimensional coefficient vector:

(5)

This coefficient indicates how much each principal component contributes to the representation of the given attribute.

3.3. Multiple PCA model

Describing real traffic via a single PCA model is difficult because the traffic data usually include many patterns, variations, and different types of noise. We therefore propose to use a multiple form of PCA for effective modeling of real traffic. For the multiple PCA model, we use the k-means clustering method to partition the given data into several clusters [12]. The k-means clustering is a well-known algorithm for unsupervised clustering, but is inappropriate for sparse or concave-shaped data [13, 14]. With our attributes, it is frequently the case that a particular data element may remain zero because some web pages may not be requested for a long period. Accordingly, our attribute matrix may have a high degree of sparsity. To overcome this problem, we perform k-means clustering on the values of the PCA coefficient, a _i , instead of the values of the raw data, w _i . Because the a _i values are low-dimensional and not sparse, we can easily partition the given attributes into several clusters with the coefficient.

Next, we build a PCA model on each cluster. Let w _i ^(k)be user i's attribute vector that belongs to cluster k. For each cluster, we first normalize the attribute vector by x _i ^(k)= (w _i ^(k)- μ^(k))/(σ ^(k))², where μ^(k)and (σ ^(k))² are the mean and variance vectors for cluster k, respectively. We then compute P- significant principal components, U^(k), for cluster k as described in the previous section. Once the principal components of cluster k are computed, we can reconstruct the original attribute vector with only P principal components. The reconstructed data of and their errors, ε _i , are denoted as follows:

(6)

(7)

Designed exclusively for normal traffic, our PCA model produces a good representation of the attributes of normal traffic but a poor representation of the attributes of unseen traffic. As a result, the reconstruction error is low for normal behavior but high for abnormal.

We regard the high reconstruction errors of the PCA as statistical outliers. Hence, we choose a threshold, δ^(k), of cluster k and use it as follows to determine whether the given web browsing behavior is normal:

(8)

where E[ε] and E[ε - E[ε]]² are the mean and variance of the reconstruction errors for model k, respectively. The β value is a scale factor for defining the outlier range. According to studies on outlier detection, the outlier range should deviate from the mean by more than two or three standard deviations [15].

3.4. Detection method

If a new web user, t, requests a web page from the server, then we first form attribute vector w _t and determine the best fitting model as follows:

(9)

where k = 1,...,K. The value K is the total number of clusters, and m _k is the mean of the PCA coefficients for cluster k. After selecting the best fitting model, π, we normalize w _t using μ^(π) and σ^(π). Finally, the model compares the reconstruction error, ε _t , with the error threshold, δ^(π). If ε _t > δ^(π), then the model regards the current user as an App-DDoS attack. Figures 2 and 3 show the pseudocodes of the proposed method, which includes model training and testing.

4.1. Datasets

4.2. App-DDoS attacks

To validate our detection model, we performed experiments with three types of attacks. Most studies on App-DDoS attacks restrict their experiments to random page attacks, which involve requests for randomly selected pages from the web server. Random page attacks can be easily detected by defense methods because their patterns are quite different from the behavior of a normal user. However, as mentioned, DDoS attackers have become more sophisticated and now tend to mimic the normal user behavior. Our experiments therefore include additional types of attacks that mimic the patterns of normal users, particularly main page attacks and dominant page attacks. A main page attack repeatedly requests the main page, which is the page most frequently requested by users; a dominant page attack randomly requests any of the pages frequently requested by most users.

For the App-DDoS attack datasets, we initiated App-DDoS attacks on a web server featured in other studies [4, 5, 8]. The attack traffic was generated in a network of the Korea Advanced Institute of Science and Technology (KAIST) via a modification of black energy, which is a well-known DDoS attack tool. We constructed copies of websites in the KAIST network as target systems of the attacks because of security problems. During the course of the App-DDoS attacks, we collected web logs from the web server and extracted web page request sequences. The collected sequences include 9,492 main page attacks, 14,038 random page attacks, and 9,489 dominant page attacks.

4.3. Results and analysis

To construct our App-DDoS defense model, we first projected the proposed attribute matrix into a subspace spanned by the initial principal components, , because it was highly sparse matrix. Then, we partitioned the data into several groups by k-means clustering based on the initial PCA coefficients. The parameter k was initially set to a sufficiently large number (k = 100) and clusters were merged if similar. Then, we constructed the multiple PCA models. We used seven principal components with the consideration of complexity and overfitting problems [15]; however, it could be adjusted as needed.

In this section, the performance of App-DDoS defense methods is illustrated with several sets of results. We first confirm whether the proposed attributes give good information to discriminate App-DDoS attacks or not. Figure 4 shows the results of the measurement for α _i , τ _i , and γ _i . In this figure, the measured values for normal traffic are shown in first row, and those of attacks are shown in second row. In Figure 5, the values for the h _i are also plotted. It is noted that the dimension reduction is applied for visualizing a multi-dimensional vector, h _i . We can see the differences between normal traffic and attacks in term of these values. Hence, we regard these values as important attributes even though they discard sequence-ordered information.

The proposed method discriminates App-DDoS attacks based on the reconstruction errors of the PCA. Thus, we show the reconstruction errors of a model, k, as shown in Figure 6. Here, the dots and the circles indicate the reconstruction errors of normal traffic for training data and validation data, and the axes indicate those of attack traffic for test data. Since our principal components are obtained to represent only normal traffic, the reconstruction errors for normal traffic are naturally low. On the contrary, the reconstruction errors for attack traffic are much higher than those of normal traffic. It is noted that some high values of this figure are set to 70 so as to visualize them.

We compared our method with a sequence-order-based defense method on the standard metrics such as the detection rate (DR), false positive rate (FPR), and receiver operating characteristic (ROC) curves. For that reason, we constructed a sequence-order-based defense method, which is modeled by the HsMM [8]. Webpage sequences for the HsMM were extracted from our weblogs. The best parameters were selected after experiments with a variety of parameters were conducted; initial parameters such as prior probabilities, transition matrix, and observation matrix were randomly set.

For the purpose of comparison, we first conducted experiments on various decision thresholds. The DR and the FPR were measured on each dataset and averaged. Table 2 shows the results of the experiment. As the threshold became large, the models yielded a relatively low DR and a low FPR, and vice versa. Our method tended to detect more App-DDoS attacks on all thresholds but its FPR was slightly higher than that of the HsMM. Figure 7 shows the ROC curves comparing our method and the HsMM. In this figure, we can see that the DR of our method is higher than that of the HsMM at most FPRs. When we carefully take into account the DR, the FPR, and ROC curves, the threshold can be set between μ + 2σ and μ + 3σ. This result is the same as that of studies based on outlier detection: the thresholds are usually set to two or three standard deviations from the mean [16]. In this experiment, our detection model has a DR of 86.7% and an FPR of 4.5% for a threshold of μ + 2.5σ, and the HsMM has a DR of 74.3% and an FPR of 5.4% for a threshold of μ + 2σ.

	Proposed		HsMM
Threshold	DR(%)	FPR(%)	DR(%)	FPR(%)
μ + σ	95.4	20.9	89.9	14.7
μ + 1.5σ	94.3	11.8	83.8	7.8
μ + 2σ	91.4	9.1	74.3	5.4
μ + 2.5σ	86.7	4.5	64.3	3.4
μ + 3σ	83.8	4.0	38.5	1.7
μ + 3.5σ	77.0	3.2	33.7	0.5

One of the advantages of our detection method is to enable additional information to be easily inserted into the model. For the purpose of adding attributes, our method can use any types of numerical attributes, while the HsMM requires only types of ordered data. Thus, network experts' opinions can easily be applied to our method for improving the detection performance. For example, it was difficult to detect main page attacks on the community website because the same page was also repeatedly requested by normal users. In this case, we can utilize information about the HTTP status codes and parameters of server scripts. Thus, we extracted this information from weblogs and simply attached two additional values to the attribute vector: v₁ = e_i/L _i and v₂ = p_i/L _i , where the e_i is the number of requests whose status code includes an error (i.e., 404 Not Found) in a sequence i. The value p_i is the number of the pages that include the same script parameters (i.e., "id = 1") in a sequence i. Figure 8 shows the results of measurement for normal traffic and attacks. The main page attack includes three types of script parameter patterns: (1) no script parameter, (2) random script parameters, and (3) increasing script parameters. Adding new attributes helps improving the DR for the main page attacks. For main page attacks on dataset2, the DR is originally 49.1% but we can achieve a DR of 83.7% as shown in Table 3 after attaching two new attributes into the attribute vector.

4.4. Early warning system

The proposed method can be used as an early warning system. A detection method that utilizes sequences should determine the sequence length at which the algorithm is launched. The general principle for determining the sequence length is as follows: the shorter the sequence, the earlier the response--albeit with less reliability. Figure 9 shows the average reconstruction errors as the sequence length varies. The reconstruction error for legitimate users remains at a certain level whereas the error for attacks becomes large as the sequence length varies from short to long. Therefore, if the DDoS detection model is launched with an appropriately short sequence length, the model can act as an early warning system. Although the proposed model may make incorrect decisions, it gradually refines its decisions as enough requests are obtained.