Canopy: A Learning-based Approach for Automatic Low-and-Slow DDoS Mitigation

Lucas Cadalzo, Christopher Todd, Banjo Obayomi, W. Moore, Anthony Wong

2021

Abstract

In a low-and-slow distributed denial-of-service (LSDDoS) attack, an adversary attempts to degrade the server with low-bandwidth requests specially crafted to slowly transmit data, consuming an inordinate amount of the server’s resources. This paper proposes Canopy, a novel approach for detecting LSDDoS attacks by applying machine learning techniques to extract meaning from observed patterns of TCP state transitions. While existing works have presented techniques that successfully mitigate different examples of LSDDoS attacks, Canopy has uniquely shown the ability to mitigate a diverse set of LSDDoS attacks, including never-before-seen attacks, all while maintaining a low false positive rate. Canopy is able to detect and mitigate low-and-slow attacks accurately and quickly: our tests find that attacks are identified during 100% of test runs within 650 milliseconds. Server performance is restored quickly: in our experimental testbed, we find that clients’ experience is restored to normal within 7.5 seconds. During active attack mitigation, which only occurs during server performance degradation indicative of an attack, Canopy exhibits minimal erroneous mitigative action applied to benign clients as it achieves a precision of 99%. Finally, we show that Canopy’s capabilities generalize well to LSDDoS attacks not included in its training dataset, identifying never-before-seen attacks within 750 milliseconds.

Paper Citation

in Harvard Style

Cadalzo L., Todd C., Obayomi B., Moore W. and Wong A. (2021). Canopy: A Learning-based Approach for Automatic Low-and-Slow DDoS Mitigation.In Proceedings of the 7th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-491-6, pages 356-367. DOI: 10.5220/0010192303560367

in Bibtex Style

@conference{icissp21,
author={Lucas Cadalzo and Christopher Todd and Banjo Obayomi and W. Moore and Anthony Wong},
title={Canopy: A Learning-based Approach for Automatic Low-and-Slow DDoS Mitigation},
booktitle={Proceedings of the 7th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2021},
pages={356-367},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0010192303560367},
isbn={978-989-758-491-6},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 7th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Canopy: A Learning-based Approach for Automatic Low-and-Slow DDoS Mitigation
SN - 978-989-758-491-6
AU - Cadalzo L.
AU - Todd C.
AU - Obayomi B.
AU - Moore W.
AU - Wong A.
PY - 2021
SP - 356
EP - 367
DO - 10.5220/0010192303560367