HTTP/2 Cannon: Experimental analysis on HTTP/1 and HTTP/2 Request Flood DDoS Attacks

David Beckett; Sakir Sezer

doi:10.1109/EST.2017.8090408

HTTP/2 Cannon: Experimental analysis on HTTP/1 and HTTP/2 Request Flood DDoS Attacks

David Beckett, Sakir Sezer

School of Electronics, Electrical Engineering and Computer Science

Research output: Contribution to conference › Paper › peer-review

12 Citations (Scopus)

1043 Downloads (Pure)

Abstract

Distributed Denial of Service (DDoS) attack sare a frequent cyber attack vector which cause significant damage to computer systems. Hypertext Transfer Protocol(HTTP), which is the core communication protocol of the internet, has had a major upgrade and is released as RFC 7540. This latest version, HTTP/2, has begun tobe deployed in live systems before comprehensive security studies have been carried out on its risk from DDoS. In this piece of research we explore using experimental methodology, the DDoS risk posed by the upgraded functionality of the HTTP/2 protocol, in particular its risk from a flood attack. Our results show that a website implementing HTTP/2, scales up the flood attack magnitude, increasing the risk from DDoS.

Original language	English
DOIs	https://doi.org/10.1109/EST.2017.8090408
Publication status	Published - 02 Nov 2017
Event	2017 Seventh International Conference on Emerging Security Technologies (EST) - Duration: 06 Sept 2017 → 08 Sept 2017

Conference

Conference	2017 Seventh International Conference on Emerging Security Technologies (EST)
Period	06/09/2017 → 08/09/2017

Access to Document

10.1109/EST.2017.8090408Licence: Unspecified

HTTP/2 Cannon: Experimental analysis on HTTP/1 and HTTP/2 request flood DDoS attacks
© Copyright 2017 IEEE. This work is made available online in accordance with the publisher’s policies. Please refer to any applicable terms of use of the publisher.
Accepted author manuscript, 155 KBLicence: Unspecified

Cite this

@conference{6bf06e16bb9b43acb5638688ab72cded,

title = "HTTP/2 Cannon: Experimental analysis on HTTP/1 and HTTP/2 Request Flood DDoS Attacks",

abstract = "Distributed Denial of Service (DDoS) attack sare a frequent cyber attack vector which cause significant damage to computer systems. Hypertext Transfer Protocol(HTTP), which is the core communication protocol of the internet, has had a major upgrade and is released as RFC 7540. This latest version, HTTP/2, has begun tobe deployed in live systems before comprehensive security studies have been carried out on its risk from DDoS. In this piece of research we explore using experimental methodology, the DDoS risk posed by the upgraded functionality of the HTTP/2 protocol, in particular its risk from a flood attack. Our results show that a website implementing HTTP/2, scales up the flood attack magnitude, increasing the risk from DDoS.",

author = "David Beckett and Sakir Sezer",

year = "2017",

month = nov,

day = "2",

doi = "10.1109/EST.2017.8090408",

language = "English",

note = "2017 Seventh International Conference on Emerging Security Technologies (EST) ; Conference date: 06-09-2017 Through 08-09-2017",

}

TY - CONF

T1 - HTTP/2 Cannon: Experimental analysis on HTTP/1 and HTTP/2 Request Flood DDoS Attacks

AU - Beckett, David

AU - Sezer, Sakir

PY - 2017/11/2

Y1 - 2017/11/2

N2 - Distributed Denial of Service (DDoS) attack sare a frequent cyber attack vector which cause significant damage to computer systems. Hypertext Transfer Protocol(HTTP), which is the core communication protocol of the internet, has had a major upgrade and is released as RFC 7540. This latest version, HTTP/2, has begun tobe deployed in live systems before comprehensive security studies have been carried out on its risk from DDoS. In this piece of research we explore using experimental methodology, the DDoS risk posed by the upgraded functionality of the HTTP/2 protocol, in particular its risk from a flood attack. Our results show that a website implementing HTTP/2, scales up the flood attack magnitude, increasing the risk from DDoS.

AB - Distributed Denial of Service (DDoS) attack sare a frequent cyber attack vector which cause significant damage to computer systems. Hypertext Transfer Protocol(HTTP), which is the core communication protocol of the internet, has had a major upgrade and is released as RFC 7540. This latest version, HTTP/2, has begun tobe deployed in live systems before comprehensive security studies have been carried out on its risk from DDoS. In this piece of research we explore using experimental methodology, the DDoS risk posed by the upgraded functionality of the HTTP/2 protocol, in particular its risk from a flood attack. Our results show that a website implementing HTTP/2, scales up the flood attack magnitude, increasing the risk from DDoS.

U2 - 10.1109/EST.2017.8090408

DO - 10.1109/EST.2017.8090408

M3 - Paper

T2 - 2017 Seventh International Conference on Emerging Security Technologies (EST)

Y2 - 6 September 2017 through 8 September 2017

ER -

HTTP/2 Cannon: Experimental analysis on HTTP/1 and HTTP/2 Request Flood DDoS Attacks

Abstract

Conference

Access to Document

Fingerprint

Cite this