Low and slow Attack characteristic Analysis

以作者查詢圖書館館藏

、以作者查詢臺灣博碩士

、以作者查詢全國書目

、勘誤回報

、線上人數：105

、訪客IP：3.135.183.89

姓名

王蕙儀(Hui-Yi Wang) 查詢紙本館藏

畢業系所

資訊工程學系在職專班

論文名稱

(Low and slow Attack characteristic Analysis)

相關論文

★ USB WORM KILLER: Cure USB Flash Worms Through a USB Flash Worm	★ Discoverer- Rootkit即時偵測系統
★ 一項Android手機上詐騙簡訊的偵測與防禦機制	★ SRA系統防禦ARP欺騙劫持路由器
★ A Solution for Detecting and Defending ARP Spoofing on Virtual Machines	★ 針對遠端緩衝區溢位攻擊之自動化即時反擊系統
★ 即時血清系統: 具攻性防壁之自動化蠕蟲治癒系統	★ DNSPD: Entrap Botnets Through DNS Cache Poisoning Detection
★ TransSQL: A Translation and Validation-based Solution for SQL-Injection Attacks	★ A Spam Mail-based Solution for Botnet Detection and Network Bandwidth Protection
★ Shark: Phishing Information Recycling from Spam Mails	★ FFRTD: Beat Fast-Flux by Response Time Differences
★ Antivirus Software Shield against Antivirus Terminators	★ MAC-YURI : My ACcount, YoUr ResponsIbility
★ KKBB: Kernel Keylogger Bye-Bye	★ CIDP Treatment: An Innovative Mobile Botnet Covert Channel based on Caller IDs with P8 Treatment

檔案

[Endnote RIS 格式]

[Bibtex 格式]

[相關文章]

[文章引用]

[完整記錄]

[館藏目錄]

至系統瀏覽論文 (2028-1-1以後開放)

摘要(中)

Low and Slow Attack 是一種阻斷服務攻擊 (denial-of-service，DoS)，由用戶端向伺服器端發送看似合乎規則的低速率封包，藉此占用連線
資源或是將資源耗盡，是一種在應用層上的 DoS/DDoS 攻擊方式，目
前常見的工具是 Slowloris 及 R-U-Dead-Yet，這兩種工具是運用慢速的
HTTP 請求手法攻擊，然而因為此種攻擊方式與慢速的正常使用者間無
明確界定點，所以較難發現，在這篇論文中主要監聽慢速攻擊下的封包，
並對其特徵實施分析，以利後續防禦參考使用。

摘要(英)

Low and Slow Attack is a kind of denial-of-service (DoS) attack. Sending seemingly compliant low-rate packets from the client to the server to occupy connection resources or exhaust resources,it’s a kind method of DoS/DDoS attack at the application layer. Currently, the common tools are Slowloris and R-U-Dead-Yet, these two tools use slow HTTP requests.
However, because there is no clear definition between this attack method and normal but slow users, it is difficult to detect. In this paper, will monitoring slow packets under slow attack, and analyze their characteristics for subsequent defense reference.

關鍵字(中)

★ 慢速攻擊
★ 阻斷服務攻擊
★ HTTP 請求

關鍵字(英)

★ Low and Slow Attack
★ Distributed Denial of Service (DDoS)
★ HTTP requests

論文目次

摘要........................................i
Abstract...................................ii
誌謝.......................................iii
目錄........................................iv
圖目錄......................................vi
表目錄.....................................viii
第 1 章緒論.................................1
第 2 章背景介紹..............................3
2.1 HTTP 與 TCP/IP 協定......................3
2.1.1 HyperText Transfer Protocol............3
2.1.2 TCP(Transmission Control Protocol).....4
2.2 Low and Slow Attack......................5
2.2.1 Slow header attack.....................5
2.2.2 Slow body attack.......................6
2.2.3 Slow read attack.......................6
第 3 章相關研究..............................7
3.1 Slowloris................................7
3.2 R-U-Dead-Yet(R.U.D.Y)....................8
3.3 SlowHTTPTest.............................8
3.3.1 Slowloris..............................8
3.3.2 Slow HTTP POST.........................9
第 4 章系統設計..............................10
第 5 章實驗結果及分析.........................13
5.1 實驗系統環境..............................13
5.2 實驗測試實況..............................13
5.2.1 一般使用者連線..........................13
5.2.2 R.U.D.Y. 模式..........................20
5.3 實驗測試分析情況..........................23
第 6 章討論.................................24
6.1 攻擊特徵.................................24
6.2 解決方案與限制因素........................24
第 7 章總結.................................25
參考文獻.....................................26

參考文獻

[1] Sceaf Berry. “2022 年策劃一場網路攻擊要多少錢？.” (Jul. 2022), [Online]. Available: https://big5.ftchinese.com/story/001096569?from=FT_P_R&archive
[2] NETSCOUT. “What is a DDoS attack?” (), [Online].Available: https://www.netscout.com/what-is-ddos
[3] Omer Yoachimik. “2022 年第二季度 DDoS 攻擊趨勢.” (2022), [Online]. Available:https://blog.cloudflare.com/zh-tw/ddos-attack-trends-for-2022-q2-zh-tw/
[4] NETSCOUT. “What is a low and slow DDoS attack?” (Jun. 2021), [Online]. Available: https://www.netscout.com/what-is-ddos/low-slow-attack
[5] D. 保護團隊. “2022 年第二季度 ddos 攻擊趨勢.” (Jul. 2022), [Online]. Available: https : / / radar . cloudflare . com / reports / ddos - 2022 - q2
[6] wiki. “超文本傳輸協定.” (2022), [Online]. Available: https://zh.%20wikipedia.
org/zh-tw/%E8%B6%85%E6%96%87%E6%9C%AC%E4%BC%A0%E8%BE%93%E5%8D%8F%E8%AE%AE
[7] 數瀾科技. “一篇搞懂 tcp、HTTP、socket、socket 連接池.” (Oct. 2019), [Online].Available: https://twgreatdaily.com/S6nI220BMH2_cNUge92C.html
[8] R. Bhardwaj. “HTTP vs tcp : Detailed comparison.” (2022), [Online]. Available:
https://networkinterview.com/http-vs-tcp-know-the-ifference/
[9] wiki. “Slow DoS attack.” (2022), [Online]. Available: https://en.wikipedia.org/
wiki/Slow_DoS_Attack
[10] H. GABRIELSON. “DDoS: It’s not a matter of if, but when.” (2019), [Online]. Available: https://www.riverbed.com/blogs/ddos-detect-mitigateattacks-steelcentral-netprofiler.html
[11] NETSCOUT. “What is a slow read DDoS attack?” (2022), [Online]. Available:
https://www.netscout.com/what-is-ddos/slow-read-attacks
[12] wiki. “Slow loris.” (2022), [Online]. Available: https://en.wikipedia.org/wiki/Slowloris_(computer_security)
[13] RSnake. “Slowloris http DoS.” (Apr. 2016), [Online]. Available: https://web.
archive.org/web/20090822001255/http://ha.ckers.org/slowloris/
[14] sahilchaddha. “Rudyjs ( ru-dead-yet?)” (May 2018), [Online]. Available: https:/ / github . com / sahilchaddha / rudyjs / blob / master / README . md
[15] PoiBlackTea. “Slowhttptest 筆記-1.” (Oct. 2021), [Online]. Available: https://tw . coderbridge . com / series / 491d43e7aa544990a95508290226f5e3 / posts /e3b4da297864489992e5a4eedf48bc9a
[16] Shekyan. “Slowhttptest.” (May 2021), [Online]. Available: https://github.com/shekyan/slowhttptest

指導教授

許富皓(Fu-Hau Hsu)

審核日期

2023-1-16

推文