Banjo Obayomi -- CAMLIS 2019

In a low-volume distributed denial-of-service (LVDDoS) attack, an adversary attempts to overwhelm the server by making requests specially crafted to use an inordinate amount of the server's resources. The imbalance between the resources used by the server and attacker during an LVDDoS attack allows otherwise resource-constrained adversaries to mount effective attacks on large systems. Standard defense tools focus on metrics such as the number of requests and don't focus on nuanced metrics such as user experience. We propose Canopy, a novel approach for detecting LVDDoS attacks by applying machine learning techniques to extract meaning from observed patterns of TCP state transitions. We differentiate between malicious and benign traffic by employing a supervised learning approach, using features extracted from the temporal patterns of TCP state transitions.