Characterizing the performance of web service frameworks under security attacks

Abstract

Web Services are a platform-independent technology that enables business processes to be accessible worldwide. In this context, web service frameworks play a key role as intermediate layers, offering support for interoperability and communication between providers and consumers. Due to their relevance in the overall infrastructure, frameworks are a frequent target of attacks trying to impact the performance of the provided services. This paper proposes an experimental approach for assessing the performance of web service frameworks under the presence of security attacks. The approach is based on a client that exchanges non-malicious messages with an infrastructure that includes the framework being assessed and several web service applications. Attacks are performed by a malicious client application and performance measures are collected during the process (from the point-of-view of legitimate users). Five web service frameworks have been assessed and results show that improvements are urgently needed, as several cases of performance degradation were observed.