延迟具有危险的结局：缓慢的HTTP/2 DoS攻击及其使用事件序列分析的实时的检测
Delays have Dangerous Ends: Slow HTTP/2 DoS attacks into the Wild and their Real-Time Detection using Event Sequence Analysis
摘要：
由Jon Postel在TCP实现的早期版本中编写的鲁棒性原则指出，通信实体在接受数据时应该是自由的。互联网上的一些实体确实遵循这一原则。例如，在这项工作中，我们表明，许多流行的Web服务器在互联网上是慷慨的，因为他们等待了相当长的时间来接收一个不完整的Web请求的剩余部分。不幸的是，这种行为也使他们容易受到一类网络攻击，通常称为慢速拒绝服务攻击。HTTP/2是HTTP的最新版本，最近发现容易受到这些攻击。然而，Slow HTTP/2 DoS攻击对Internet上真实Web服务器的影响尚未得到研究。此外，据我们所知，目前还没有一种防御方案可以实时的【形】检测针对HTTP/2的慢速拒绝服务攻击。为了弥补这些差距，我们首先测试支持Internet上Web服务器的HTTP/2针对慢速HTTP/2拒绝服务攻击的行为。随后，我们提出了一个计划来检测这些攻击的实时的【形】性。我们表明，所提出的检测方案可以检测攻击的实时的【形】性，高精度和边际计算开销。
英文摘要：
The robustness principle, written by Jon Postel in an early version of TCP implementation, states that the communicating entities should be liberal while accepting the data. Several entities on the Internet do follow this principle. For instance, in this work, we show that many popular web servers on the Internet are generous as they wait for a substantial time period to receive the remaining portion of an incomplete web request. Unfortunately, this behavior also makes them vulnerable to a class of cyber attacks, commonly known as Slow Rate DoS attacks. HTTP/2, the recent version of HTTP, is recently found vulnerable to these attacks. However, the impact of Slow HTTP/2 DoS attacks on real web servers on the Internet has not been studied yet. Also, to the best of our knowledge, there is no defense scheme known to detect Slow Rate DoS attacks against HTTP/2 in real-time. To bridge these gaps, we first test the behavior of HTTP/2 supporting web servers on the Internet against Slow HTTP/2 DoS attacks. Subsequently, we propose a scheme to detect these attacks in real-time. We show that the proposed detection scheme can detect attacks in real-time with high accuracy and marginal computational overhead.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
