On Detection and Mitigation of Slow Rate Denial of Service Attacks This work investigates the detection and mitigation methods that aim at Slow Denial of Service attacks. The paper focuses mainly on Slowloris and Slow Read DoS attacks which are resistant to classical DoS detection and mitigation techniques. The proposed approach consists of the detection phase and mitigation phase. Detection methods are based on network traffic analysis and anomalous traffic monitoring. Furthermore, if an attack is recognized then classified malicious traffic is blocked and web server resources are released. The proposed methods are implemented and consolidated into an intrusion prevention system software. The implemented system is tested and obtained results prove its functionality.

Analysing performance issues of opensource intrusion detection systems in highspeed networks Abstract   Driven by the growing data transfer needs, industry and research institutions are deploying 100xc2xa0Gbs networks. As such highspeed networks become prevalent, these also introduce significant technical challenges. In particular, an Intrusion Detection System (IDS) cannot process network activities at such a high rate when monitoring large and diverse traffic volumes, thus resulting in packet drops. Unfortunately, the high packet drop rate has a significant impact on detection accuracy. In this work, we investigate two popular opensource IDSs: Snort and Suricata along with their comparative performance benchmarks to better understand drop rates and detection accuracy in 100xc2xa0Gbs networks. More specifically, we study vital factors (including system resource usage, packet processing speed, packet drop rate, and detection accuracy) that limit the applicability of IDSs to highspeed networks. Furthermore, we provide a comprehensive analysis to show the performance impact on IDSs by using different configurations, traffic volumes and different flows. Finally, we identify challenges of using opensource IDSs in highspeed networks and provide suggestions to help network administrators to address identified issues and give some recommendations for developing new IDSs that can be used for highspeed networks.