Detection and Deactivation of Application Layer-Based DDoS Attack from Private Tor Network

Abstract

The Botnet is the network of personal computers with malicious software, connected to the Internet and controlled by BotMaster. It is considered to be the most catastrophic cyber-security threat such as phishing, spamming, DDoS, or any kind of malware. In this work, our contribution is to provide a secure network service against DDoS attacks for Tor users. The detection and deactivation of Application Layer Based DDoS attack known as “Hammer.py Bot” is explained in detail. Application layer based (L7) attacks are serious yet challenging to detect. The detection framework is based on Delta time (TΔ), which is the time between two threads/requests in milliseconds. When attack “Hammer.py” does exist in the target machine, it will start sending multiple requests to victim machine, the machine became busy and stops performing its normal activities. The proposed technique leads to detect the bot as soon as it exists in the system. The average true positive rate (TPr) and accuracy of the proposed technique is 95.92%, and the average false negative rate (FNr) and error rate is 4.08%.