Earticle

In order to predict network users’ access behavior accurately, this paper proposes a new prediction model based on Web access behavior. To improve prediction performance and reduce the state-space complexity, the model uses hybrid-order Markov chain structure and stores the sequences which share the same prefix. The problems that lower-order models have poor prediction performance and higher-order models result in high state-space complexity are solved in this paper. Simulation results have shown that the prediction model based on Web access behavior can improve the precision and recall to some extent.

Nowadays, distributed denial of service (DDoS) attacks on web sites reward attackers financially or politically because our daily lifes tightly depends on web services such as on-line banking, e-mail, and e-commerce. One of DDoS attacks to web servers is called HTTP-GET flood attack which is becoming more serious. Most existing techniques are running on the application layer because these attack packets use legitimate network protocols and HTTP payloads; that is, network-level intrusion detection systems cannot distinguish legitimate HTTP-GET requests and malicious requests. In this paper, we propose a practical detection technique against HTTP-GET flood attacks, based on the access behavior of inline objects in a webpage using NetFlow data. In particular, our proposed scheme is working on the network layer without any application-specific deep packet inspections. We implement the proposed detection technique and evaluate the ability of attack detection on a simple test environment using NetBot attacker. Moreover, we also show that our approach must be applicable to real field by showing the test profile captured on a well-known e-commerce site. The results show that our technique can detect the HTTP-GET flood attack effectively.