# SDToW: A Slowloris Detecting Tool for WMNs
## 1 Introduction  
Currently, denial of service (DoS) attacks create a significant threat to the available resources on the Internet and internal networks. DoS aims to prevent legitimate users from accessing resources available on the network. The attack can exploit vulnerabilities or depletes resources on the target. Consequently, it directly affects the performance of network services [1; 2; 3]. There is a group of DoS attacks designed to consume resources from Web and E-mail services. This resource-consuming strategy consequently makes the application services inaccessible on the network. Most DoS attacks create a large number of open or semi-open TCP connections on the target host [4; 5]. These open TCP connections disable the server from accepting legitimate requests due to many waiting connections on its sockets. Moreover, the attack consumes memory and processing during its execution. This resource consumption behavior has encouraged studies to design new DoS attack detection systems and damage reduction mechanisms [6]. The literature separates DoS attacks into those that target specific vulnerabilities and those that use flooding attacks [7]. In flooding attacks, the target receives a continuous and excessive volume of packets. Thus, traffic from legitimate sources can be blocked due to congestion and discarding packets. Regarding vulnerability attacks, the target host receives malformed packets [8]. These malformed packets interact with flaws or vulnerabilities in an application or resource hosted by the target. Another group of DoS attacks specifically exploit the application layer, defined as application layer DoS (ADoS) [9]. Two types of ADoS attacks can be highlighted: flooding and low-rate. The first one produces an excessive flow of traffic, consuming resources on the application level. The secondcreates traffic similar to legitimate requests, using vulnerabilities found in the application. Common vulnerabilities exploited by these attacks are the HTTP and HTTPS protocols. This vulnerability permits one to retain connections indefinitely [10]. Low-rate attacks, such as Slowloris, consume resources mainly on the target services without significantly affect the attacker's resources. The Slowloris attack consists of sending multiple HTTP requests to the Web servers. These requests are similar to the Web browser clients' requests, and therefore it creates challenges to detect the attack. Slowloris send its packets without finishing the HTTP request. Additionally, Slowloris sends periodic incomplete requests to ensure that the server does not finish the connection due to a lack of response. Without knowing if the HTTP requests belong to a legitimate client, the server keeps the connection open. These Slowloris requests are sent in parallel with different source ports to occupy the resources on the server. After consuming the server's resources, it creates an inability to fulfill the new legitimate requests. The existing literature provides a considerable number of solutions to the Slowloris attack. Some of these solutions use strategies such as limiting the number of connections for each user or defining timeouts for each connection [11]. These limitations can prevent legitimate users from maintaining connections that exceed a pre-established limit. Legitimate users accessing pages with many objects in non-persistent HTTP connection mode can easily exceed this limit. Additionally, strategies that limit the connection timeout can block users that have idle connections. Our solution differentiates from the ones present in the literature because it is designed to work on wireless mesh networks. Wireless mesh networks (WMNs) have proven to be an alternative to provide low-cost access to the Internet and network resources. The WMNs backbone consists of stationary nodes providing a mesh of connectivity [12]. These wireless nodes play an essential part in traffic routing performance [13]. Clients can access the network resources using the WMNs nodes, thereby accessing Web servers, DNS and the Internet.