DIADEM Firewall: Web Server Overload Attack Detection and Response

Gerhard Münz , Ali Fessi , Georg Carle (1) , Olivier Paul (2) , Dušan Gabrijelčič , Yannick Carlinet , Sherif Yusuf , Morris Sloman , Vrizlynn Thing , Jan van Lunteren , Patricia Sagmeister , Gero Dittmann

1 TUM - Technische Universität Munchen - Technical University Munich - Université Technique de Munich
2 TSP - Télécom SudParis

High-profile web servers often become the victim of web server overload Distributed Denial-of-Service (DDoS) attacks. Motivations of such attacks range from technical challenge (e.g. script kiddies) to financial profit (e.g. blackmailing the web server's owner). This paper presents the DIADEM Firewall architecture that allows an ISP to protect its customers from being the target of a DDoS attack. Additionally, it provides protection against usage of customer hosts for attacks. Furthermore, the use-case of the web server overload attack detection and response mechanism will be explained in more details. Finally, we outline the integration an FPGA based highspeed classifier engine integrated into the Linux Netfilter firewall as well as its deployment during a response action against the DDoS attack.

Domaines: Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Gerhard Münz, Ali Fessi, Georg Carle, Olivier Paul, Dušan Gabrijelčič, et al.. DIADEM Firewall: Web Server Overload Attack Detection and Response. Broadband Europe (BBEurope), Dec 2005, Bordeaux, France. ⟨hal-03643660⟩