Flash Crowd Detection Using Decoy Hyperlinks

In this paper a novel method for detecting denial of service attacks (DoS) on web services are presented and evaluated by using decoy hyperlinks embedded in web pages. The decoys are hyperlinks without semantic information or are invisible to the human user, acting like traps for DoS attacks because a human user would never follow them. An attack on a web server is detected when such hyperlink is followed. This approach has significant advantages over other approaches like graphic Turing tests, it is transparent to the user, it can be used on general-purpose web sites and retains the web site´s usability. The proposed method has been evaluated using real web sites and the results show false positive rates that are less than 10^-4. A genetic algorithm is used for the optimum placement of the decoys using simulated web sites. The aspects of this new method are discussed and some experimental results are presented.