Deteção de ataques HTTP/2 Rapid Reset - Modelos Machine Learning
Fonseca, Eduardo João Lopes da
MSc Thesis · 2024 · University of Coimbra
Supervisors: Bruno Miguel de Oliveira Sousa, Tiago José dos Santos Martins da Cruz
Abstract
The crescent threat of Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks is a concern to all businesses that want to assure availability of their services to legitimate users. A new vulnerability, considered zero-day until October 2023, was discovered and exploited using botnets to create a Distributed Denial of Service attack. The attacks used the HTTP protocol to abuse a specific characteristic existing in version 2 of this protocol, the ability to cancel the state of a stream. This vulnerability is known as HTTP/2 Rapid reset and allows an attacker to bypass the configuration agreed with servers to send more concurrent streams that what was agreed, running out the server’s resources and compromising server’s availability. As the majority of the HTTP traffic seen in the internet is HTTP/2 there is a constant threat that attacks can use to affect multiple servers. The goal of this project is to prioritize Machine Learning technologies, more especially, those belonging to the supervised learning category, in order to providea more comprehensive defense-in-depth strategy. Projects made available to the security community as Proof of Concept were used to investigate and identify the threat. Additionally, Python was used to create a Proof of Concept that allowed the attack to be simulated in both HTTP and HTTPS environments. The work developed demonstrates the effectiveness of supervised learning algorithms in detecting vulnerabilities in encrypted traffic, which could be a security control to consider, in order to anticipate the detection of threats that exploit the existent vulnerability in the HTTP/2 protocol.