# SDToW: A Slowloris Detecting Tool for WMNs
## 2 Related Works  
Slowloris attacks have proven to be worthy of attention regarding the difficulty of countermeasures for their severe effects. The literature provides many works to face this challenge. However, the majority of the solutions present a high level of complexity and time-consuming responses [11]. Some of the solutions uses IPTABLES [15] and Apache modules [16] to provide countermeasures against Slowloris attacks. However, Apache modules such as modevasive [17] and modqos [18] do not efficiently reduce the attacks' impacts [11]. Furthermore, IPTABLES relies on a threshold to count the number of active connections, which can create false positive errors. An advanced policy firewall (APF) [19] can also be used to counter this attack, but like IPTABLES, its constraints can also lead to false positive errors [20]. The combination of Apache modules and detection tools can also be used in a cloud computing environment [21]. Some studies state that it is possible to use a combination of the timeout and the minimum data rate per request received at the server [22; 23; 24]. Therefore, those studies investigated the slow ongoing connections to mitigate the effects of slow DoS attacks, as occurs in Slowloris. [PERSON] et al. analyzed two intrusion detection system (IDS) tools to detect Slowloris [25]. The first, called Suricata [26], does not generate an adequate number of alerts to detect Slowloris attack. The second tool, called SNORT [27; 28], performs the detection using a trade-off between memory and processing consumption. Snort has been widely used against cybercrimes[29; 30; 31]. Lately, in this work, we compare the performances of Snort and our tool. Another tool, called SeVen, provides a defense module based on a selective strategy that uses probability functions to choose among the new requests that will be accepted or rejected when the Web server is saturated [32]. Consequently, when a new request arrives at the application, SeVen checks for availability in the server connections pool. If there are no more available resources for connections, it uses probability to determine which of the established connections must be closed. Another approach designed to detect attacks on the application layer, such as Slowloris, uses signature-based DoS attack detection and anomaly detection techniques [16; 33; 34]. Detecting a signature-based DoS attack requires statistical monitoring of the incoming traffic. This strategy produces satisfactory attack detection if the inspected traffic has predefined characteristics of malicious activity. Alternatively, artificial intelligence can be used to detect malicious signatures in application DoS attacks [35; 36; 37; 38]. However, these approaches have limitations, given the existing traffic variations concerning the HTTP requests. Therefore, considering that Slowloris creates traffic similar to legitimate connections, this detection strategy could lead to false positive errors. A critical challenge for these approaches relies on determining the majority of legitimate traffic behavior that will be applied to the training sessions [39; 40; 41]. [PERSON] et al. proposed an anomaly detection system that measures the Hellinger distance between two probability arrangements [42]. The authors obtained the results using a subset of training and tests. During the test phase, the authors compared the attack traffic and the pattern produced in the training phase. They used the most recent HTTP request pattern, using the Hellinger distance to determine the difference between the two probability arrangements. However, the classification method presents false positives, considering the system's probability to differentiate malicious traffic from legitimate traffic. Furthermore, [PERSON] et al. considers that the process of flow data creation is often neglected on Slowloris analysis [43]. Therefore, it leads to negative data analytic results. Our solution presents improvements, considering its efficiency to detect and block the attack.