[Paper Review] Delays have Dangerous Ends: Slow HTTP/2 DoS attacks into the Wild and their Real-Time Detection using Event Sequence Analysis

Nikhil Tripathi|arXiv (Cornell University)|Mar 31, 2022

Network Security and Intrusion Detection4 citations

TL;DR

This paper proposes a real-time detection scheme for Slow HTTP/2 DoS attacks using event sequence analysis, leveraging mismatch scores between normal and anomalous sequences to identify attacks with high accuracy and minimal computational overhead. The method achieves near-perfect detection (100% recall) and low false positive rates in real-world testing, demonstrating strong practical viability for securing HTTP/2 servers.

ABSTRACT

The robustness principle, written by Jon Postel in an early version of TCP implementation, states that the communicating entities should be liberal while accepting the data. Several entities on the Internet do follow this principle. For instance, in this work, we show that many popular web servers on the Internet are generous as they wait for a substantial time period to receive the remaining portion of an incomplete web request. Unfortunately, this behavior also makes them vulnerable to a class of cyber attacks, commonly known as Slow Rate DoS attacks. HTTP/2, the recent version of HTTP, is recently found vulnerable to these attacks. However, the impact of Slow HTTP/2 DoS attacks on real web servers on the Internet has not been studied yet. Also, to the best of our knowledge, there is no defense scheme known to detect Slow Rate DoS attacks against HTTP/2 in real-time. To bridge these gaps, we first test the behavior of HTTP/2 supporting web servers on the Internet against Slow HTTP/2 DoS attacks. Subsequently, we propose a scheme to detect these attacks in real-time. We show that the proposed detection scheme can detect attacks in real-time with high accuracy and marginal computational overhead.

Motivation & Objective

• To evaluate the real-world vulnerability of HTTP/2 web servers to Slow Rate DoS attacks in the wild.
• To address the lack of real-time detection mechanisms for Slow HTTP/2 DoS attacks, which existing defenses for HTTP/1.1 cannot mitigate.
• To design and validate a lightweight, real-time detection scheme based on event sequence analysis that minimizes false positives and computational cost.

Proposed method

• The scheme uses event sequence analysis to model normal and anomalous HTTP/2 request patterns based on frame sequences.
• It computes a mismatch score between observed event sequences and a learned normal profile using a sliding window of size n.
• The detection threshold (t) is tuned in the range [0.01, 0.02] to balance false positives and false negatives.
• The system classifies sequences as anomalous if the mismatch score exceeds the threshold, enabling early detection.
• The method dynamically extracts lookahead pairs from sequences to enable low-latency classification.
• Computational overhead is monitored via CPU utilization, showing less than 7% usage in most intervals, confirming low resource cost.

Experimental results

Research questions

• RQ1 How prevalent is HTTP/2 adoption among top websites, and what is its real-world security posture against Slow HTTP/2 DoS attacks?
• RQ2 To what extent are real-world HTTP/2 servers vulnerable to Slow Rate DoS attacks due to connection delay behavior?
• RQ3 Can event sequence analysis effectively detect Slow HTTP/2 DoS attacks in real time with minimal false positives and low computational cost?
• RQ4 How do varying window sizes (n) affect detection accuracy, latency, and computational overhead?
• RQ5 What threshold value (t) optimally balances detection performance and false positive rates in the proposed scheme?

Key findings

• Approximately 71% of the top 500K Alexa websites support HTTP/2, indicating widespread deployment and relevance for security analysis.
• Several popular HTTP/2 web servers were found vulnerable to Slow HTTP/2 DoS attacks due to prolonged connection retention after incomplete requests.
• The proposed detection scheme achieved 100% recall and over 98% accuracy in real-world testing, with false positive rates below 2.04%.
• Detection latency was consistently under 30 seconds for all anomalous sequences, enabling timely response.
• The scheme incurred minimal computational overhead, with CPU usage below 7% in most intervals, making it suitable for production deployment.
• Optimal detection performance was achieved with a mismatch score threshold (t) in the range [0.01, 0.02], balancing false positives and false negatives.