Network anomaly detection based on flow intensity measuring in the decay model for DDoS protection
This article discusses the problem of detecting network anomalies in the context of protecting a web server against (D)DoS attacks aimed at the exhaustion of the server resources. The solution of the problem is necessary to ensure the correct performance of network applications. At one stage in a multi-step security process, it is necessary to monitor the intensity of incoming requests and pay special attention to cases where the intensity exceeds a specified threshold. To measure the intensity, a decay model was chosen, which is a kind of exponential moving average and describes the phenomenon of decay of a radioactive substance, therefore so named. Among the criteria for the selection of the algorithm, speed and economy of RAM consumption were important, because evaluation should be possible in real time and for a large number of different request types. The selected algorithm allows to store only one counter value in RAM for the flow, and the intensity estimate is made at the required time point by the accumulated value. In the absence of events, the counter value for the flow decreases exponentially in time and approaches zero, which is used to remove data with flow information from memory. To speed up the calculations, the counter update operation uses a table of the function's pre-calculated values. In the software implementation, the counter updating procedure consumes ~14 clock cycles of the CPU. To test the algorithm, incoming requests of different visitors were selected on the basis of expert analysis from the web server access logs: active legitimate users, search robots and attackers. For these sessions, an estimate of the intensity of queries based on the decay model was calculated. The result allows us to say that this algorithm can be used for the task in hand. In order to protect against attacks, abnormal sessions can be directed to an additional classifier designed to determine user legitimacy based on other criteria.