2

I want to apply an algorithm on my Python script for HTTP flood attack detection. Main idea is to parse Apache logs to a MongoDB, but i want to extract only those lines that indicates an HTTP flood attack. Any idea please?

1

I would suggest using a tool that is geared towards log aggregation/parsing such as the ELK stack (Elastic search, Logstash and Kibana). After a couple of hours of research into the context and tools, you will be able to set up a logstash pipeline and a filter plugin that will suit your needs.

Parsing apache logs in particular is a very mature use case.

Regarding your specific question, some good generic starting points would be:

Detection of randomized subdomain requests ([gibberish].yourdomain.com), multiple and isolated requests targeted at a specific resource of your site (i.e an image, text file etc..) coming from random IPs, abuse of forms present on your site (multiple requests to your target script) or abusive entries in fields that traditionally have processing attached to them (uploads of malformed/large files).

Considering the context of your question, I would suggest basing my PoC on a specific common design flaw or popular package vulnerability in order to illustrate the detection techniques that might be relevant.

Perform the following search on google and it will yield DoS vulns that you can replicate and have working exploits that you can build countermeasure against: "apache dos site:exploit-db.com".

  • I know about ELK stack, but it's about an academic project, so i have to write a python scipt for detecting DoS Attack (especially HTTP flood attack), while parsing logs from Apache and Snort. – Alex Botzis Aug 20 '16 at 11:28
  • Could you edit your question to include HTTP server type/version, hosting model and type of web application (stack behind it etc..)?. These are relevant to determine your attack surface. – dotproi Aug 20 '16 at 11:43
  • The web application is a simple Apache2 Server running on Ubuntu 14.04 LTS. The whole project is a little dummy, i want to research methods and build a simple application. – Alex Botzis Aug 20 '16 at 11:47
  • got it, I have edited my response based on your input. I strongly suggest you pivot off of a known and exploitable scenario. It's kinda like building a crossword puzzle, easier when you start off with the answers and fill the rest with gibberish :-) – dotproi Aug 20 '16 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.