An active defense model for Web Accessing DoS attacks

This paper analyses the characteristics of the Web Accessing DoS attacks, then proposes an active defense model. Based on the differences of data and time between the Web Accessing DoS attacks and the normal users´ browsing behavior, the active defense model will divide the web accessing traffic into three types: the normal browsing traffic, the actual attacking traffic, the dubitable attacking traffic. The policies for accessing traffic are different: the normal browsing traffic is permitted to access the web site; the actual attacking traffic is forbidden to access the web site; the dubitable attacking traffic will be led into the deception web site, then the active defense model will determine whether to permit the traffic to access the web site or not according to the observing result. The experimental results show that the model is effective in detecting and preventing the Web Accessing DoS attacks.