## 5 DoS and DDoS Defense
### Defenses against XML-DoS and HTTP-DoS Attacks  
**Filtering Tree. ** [PERSON] et al. [49] developed a filtering tree, which works like a service. The XML consumer request is converted into a tree form and uses a virtual Cloud defender to defend against these types of attacks. The Cloud defender basically consists of five steps: sensor filtering (check number of messages from a particular user), hop count filtering (number of nodes crossed from source to destination--this cannot be forged by the attacker), IP frequency divergence (the same range of IP addresses is suspect), puzzle (it sends a puzzle to a particular user: if it is not resolved, the packet is suspect) and double signature. The first four filters detect HTTP-DDoS attacks while the fifth filter detects XML-DDoS attacks. **Limitation. ** [PERSON] et al. [50] explain that an acceptable solution to prevent attackers from exhausting the victims' network bandwidth and computing power is to route the requests to the service providers only once they have been authenticated and validated. First, limit the payload size. Then, limit the time allocated to a SOAP request. Third, limit the number of requests a particular user can send within a given time frame. Packets that do not match those criteria are discarded and the service is blocked for the user for a certain period of time. They also propose to impose limits for the XML parser. For example, limit the number of attributes an element can have, the quantity of bytes in a XML message, the depth of nested elements and the size of all nodes in the XML document. Furthermore, to minimize the impact on the QoS for the end user in terms of delays, for instance, this could take place only when the system is under attack, which is detected by the service provider. **Cloud Protector and Decision Theory. ** [PERSON] et al. [51, 52] developed a Cloud Traceback (CTB), which uses a Service-Oriented Traceback Architecture (SOTA) approach. CTB is deployed at the edge routers in order to be close to the Cloud network source end to mark all outgoing packets. If an attack is detected, the use of a back propagation neutral network, called Cloud Protector, allows for retrieving the source of the attack. The Cloud Protector is a trained back propagation neural network, which means that there is a set of connected units associated with a given weight, spread between input, hidden and output layers. Then, the weights are added to see if the result exceeds a certain threshold, which means an attack is taking place. They also developed a method relying on decision theory, called ENDER (Pre-Decision, Advance Decision and Learning System). It uses two decision theory methods to detect attack traffic and mark the attack messages. If an attack message is detected, a Reconstruct And Drop (RAD) system removes the message before a victim is harmed. **Defense in Cloud Broker. ** [PERSON] et al. (2016) divide the concept of Cloud Computing into three parts. First, the Cloud providers deploy the VM and their web services. Then, the Cloud broker makes the link between the user and the available resources of the Cloud providers in order to allocate the necessary resources. Users request resources in the Cloud infrastructure through the Cloud broker to eventually use the web services hosted by the Cloud providers. As the author points out, the Cloud broker introduces a single point of failure, since its unavailability makes the Cloud infrastructure unusable. To make this architecture more secure, a DDoS defense system is placed with the Cloud broker to decide whether the application request should be rejected or not. The defense system, which uses DDoS datasets, is incorporated into all the broker entities. The filter is based on the definition of a normal profile usage constructed with previous requests. The filter, aimed to be scalable to overcome a DDoS, is transparent for the user.