{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,20]],"date-time":"2026-08-20T06:31:47Z","timestamp":1787207507026,"version":"build-2736575974"},"reference-count":58,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2023,2,13]],"date-time":"2023-02-13T00:00:00Z","timestamp":1676246400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,2,13]],"date-time":"2023-02-13T00:00:00Z","timestamp":1676246400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Big Data"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>With the massive resources and strategies accessible to attackers, countering <jats:italic>Denial of Service<\/jats:italic> (DoS) attacks is getting increasingly difficult. One of these techniques is application-layer DoS. Due to these challenges, network security has become increasingly more challenging to ensure. <jats:italic>Hypertext Transfer Protocol<\/jats:italic> (HTTP), <jats:italic>Domain Name Service<\/jats:italic> (DNS), <jats:italic>Simple Mail Transfer Protocol<\/jats:italic> (SMTP), and other application protocols have had increased attacks over the past several years. It is common for application-layer attacks to concentrate on these protocols because attackers can exploit some weaknesses. Flood and \u201clow and slow\u201d attacks are examples of application-layer attacks. They target weaknesses in HTTP, the most extensively used application-layer protocol on the Internet. Our experiment proposes a generalized detection approach to identify features for application-layer DoS attacks that is not specific to a single slow DoS attack. We combine four application-layer DoS attack datasets: Slow Read, HTTP POST, Slowloris, and Apache Range Header. We perform a feature-scaling technique that applies a normalization filter to the combined dataset. We perform a feature extraction technique, <jats:italic>Principal Component Analysis<\/jats:italic> (PCA), on the combined dataset to reduce dimensionality. We examine ways to enhance machine learning techniques for detecting slow application-layer DoS attacks that employ these methodologies. The machine learners effectively identify multiple slow DoS attacks, according to our findings. The experiment shows that classifiers are good predictors when combined with our selected Netflow characteristics and feature selection techniques.<\/jats:p>","DOI":"10.1186\/s40537-023-00699-3","type":"journal-article","created":{"date-parts":[[2023,2,13]],"date-time":"2023-02-13T10:03:11Z","timestamp":1676282591000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":23,"title":["An approach to application-layer DoS detection"],"prefix":"10.1186","volume":"10","author":[{"given":"Cliff","family":"Kemp","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chad","family":"Calvert","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Taghi M.","family":"Khoshgoftaar","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Joffrey L.","family":"Leevy","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2023,2,13]]},"reference":[{"issue":"1","key":"699_CR1","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-021-00460-8","volume":"8","author":"R Zuech","year":"2021","unstructured":"Zuech R, Hancock J, Khoshgoftaar TM. Detecting web attacks using random undersampling and ensemble learners. J Big Data. 2021;8(1):1\u201320.","journal-title":"J Big Data"},{"issue":"1","key":"699_CR2","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-020-00382-x","volume":"7","author":"JL Leevy","year":"2020","unstructured":"Leevy JL, Khoshgoftaar TM. A survey and analysis of intrusion detection models based on CSE-CIC-IDS2018 big data. J Big Data. 2020;7(1):1\u201319.","journal-title":"J Big Data"},{"key":"699_CR3","unstructured":"Demoulin HM, Pedisich I, Vasilakis N, Liu V, Loo BT, Phan LTX. Detecting asymmetric application-layer denial-of-service attacks in-flight with finelame. In: Proceedings of the 2019 USENIX conference on Usenix annual technical conference; 2019. p. 693\u2013707."},{"key":"699_CR4","unstructured":"Mankier. nfcapd netflow capture daemon; 2009. https:\/\/www.mankier.com\/1\/nfcapd."},{"key":"699_CR5","unstructured":"CERT: SiLK; 2022. https:\/\/tools.netsa.cert.org\/silk\/index.html."},{"key":"699_CR6","volume-title":"Applied network security monitoring: collection, detection, and analysis","author":"C Sanders","year":"2013","unstructured":"Sanders C, Smith J. Applied network security monitoring: collection, detection, and analysis. Amsterdam: Elsevier; 2013."},{"key":"699_CR7","doi-asserted-by":"crossref","unstructured":"Claise B, Trammell B, Zurich E, Aitken P. Specification of the IP flow information export (IPFIX) protocol for the exchange of flow information (RFC 7011). 2013. https:\/\/tools.ietf.org\/search\/rfc7011.","DOI":"10.17487\/rfc7015"},{"key":"699_CR8","doi-asserted-by":"crossref","unstructured":"Benzel T, Braden B, Faber T, Mirkovic J, Schwab S, Sollins K, Wroclawski J. Current developments in deter cybersecurity testbed technology. In: Conference for homeland security, 2009. CATCH\u201909. Cybersecurity Applications & Technology. IEEE; 2009. p. 57\u201370.","DOI":"10.1109\/CATCH.2009.30"},{"key":"699_CR9","unstructured":"Peterson L, Bavier A, Fiuczynski ME, Muir S. Experiences building planetlab. In: Proceedings of the 7th symposium on operating systems design and implementation. USENIX Association; 2006. p. 351\u201366."},{"key":"699_CR10","doi-asserted-by":"crossref","unstructured":"Ndibwile JD, Govardhan A, Okada K, Kadobayashi Y. Web server protection against application layer DDoS attacks using machine learning and traffic authentication. In: 2015 IEEE 39th annual computer software and applications conference (COMPSAC), vol. 3. IEEE; 2015. p. 261\u20137.","DOI":"10.1109\/COMPSAC.2015.240"},{"issue":"2","key":"699_CR11","doi-asserted-by":"publisher","first-page":"510","DOI":"10.3906\/elk-1308-188","volume":"24","author":"R Saravanan","year":"2016","unstructured":"Saravanan R, Shanmuganathan S, Palanichamy Y. Behavior-based detection of application layer distributed denial of service attacks during flash events. Turk J Electr Eng Comput Sci. 2016;24(2):510\u201323.","journal-title":"Turk J Electr Eng Comput Sci"},{"key":"699_CR12","doi-asserted-by":"publisher","first-page":"10","DOI":"10.1145\/1656274.1656278","volume":"11","author":"M Hall","year":"2009","unstructured":"Hall M, Frank E, Holmes G, Pfahringer B, Reutemann P, Witten IH. The WEKA data mining software: an update. ACM SIGKDD Explor Newsl. 2009;11:10\u20138.","journal-title":"ACM SIGKDD Explor Newsl"},{"key":"699_CR13","unstructured":"Radware. Radware\u2019s DDoS handbook: the ultimate guide to everything you need to know about DDoS attacks. 2020. https:\/\/www.radware.com\/social\/ddoshandbook\/."},{"key":"699_CR14","doi-asserted-by":"crossref","unstructured":"Zeifman I. Global DDoS threat landscape Q3 2017. 2017. https:\/\/www.incapsula.com\/ddos-report\/ddos-report-q3-2017.html.","DOI":"10.1016\/S1361-3723(17)30028-3"},{"key":"699_CR15","unstructured":"Braden R. Probing zero windows. 1989. https:\/\/tools.ietf.org\/html\/rfc1122#page-92."},{"key":"699_CR16","unstructured":"Calvert C, Kemp C, Khoshgoftaar TM, Najafabadi M. Detecting slow http post dos attacks using netflow features. In: The thirty-second international FLAIRS conference. 2019."},{"key":"699_CR17","unstructured":"CVE. CVE-2011-3192. 2011. https:\/\/www.cvedetails.com\/cve\/CVE-2011-3192\/."},{"key":"699_CR18","unstructured":"BlackmoreOps. DoS website using slowhttptest in Kali Linux slowloris, slow HTTP POST and slow read attack in one tool. 2015. https:\/\/www.blackmoreops.com\/2015\/06\/07\/attack-website-using-slowhttptest-in-kali-linux\/."},{"key":"699_CR19","unstructured":"SourceForge. Low orbit ion cannon. 2016. https:\/\/sourceforge.net\/projects\/loic\/."},{"key":"699_CR20","unstructured":"SourceForge. High orbit ion cannon. 2016. https:\/\/sourceforge.net\/projects\/high-orbit-ion-cannon\/."},{"key":"699_CR21","unstructured":"SourceForge. r-u-dead-yet. 2016. https:\/\/sourceforge.net\/projects\/high-orbit-ion-cannon\/."},{"key":"699_CR22","unstructured":"OffSec. Slowhttptest\u2014penetration testing tools. 2021. https:\/\/tools.kali.org\/stress-testing\/slowhttptest."},{"key":"699_CR23","unstructured":"Wireshark. tshark\u2014Dump and analyze network traffic. 2021. https:\/\/www.wireshark.org\/docs\/man-pages\/tshark.html."},{"key":"699_CR24","unstructured":"Tcpdump. tcpdump\u2014dump traffic on a network. 2022. https:\/\/www.tcpdump.org\/manpages\/tcpdump.1.html."},{"key":"699_CR25","unstructured":"Cisco. NetFlow version 9 flow-record format. 2011. https:\/\/www.cisco.com\/en\/US\/technologies\/tk648\/tk362\/technologies_white_paper09186a00800a3db9.html."},{"key":"699_CR26","unstructured":"Mankier. nfdump netflow display and analyze program. 2009. https:\/\/www.mankier.com\/1\/nfdump."},{"key":"699_CR27","unstructured":"Wireshark. dumpcap Dump network traffic. 2021. https:\/\/www.wireshark.org\/docs\/man-pages\/dumpcap.html."},{"issue":"4","key":"699_CR28","doi-asserted-by":"publisher","first-page":"2046","DOI":"10.1109\/SURV.2013.031413.00127","volume":"15","author":"ST Zargar","year":"2013","unstructured":"Zargar ST, Joshi J, Tipper D. A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks. IEEE Commun Surv Tutor. 2013;15(4):2046\u201369.","journal-title":"IEEE Commun Surv Tutor"},{"issue":"2","key":"699_CR29","first-page":"2242","volume":"5","author":"VP Singh","year":"2014","unstructured":"Singh VP, Pal P. Survey of different types of captcha. Int J Comput Sci Inf Technol. 2014;5(2):2242\u20135.","journal-title":"Int J Comput Sci Inf Technol"},{"key":"699_CR30","doi-asserted-by":"crossref","unstructured":"Chwalinski P, Belavkin R, Cheng X. Detection of application layer ddos attack with clustering and likelihood analysis. In: 2013 IEEE Globecom Workshops (GC Wkshps), 2013. p. 217\u2013222. IEEE","DOI":"10.1109\/GLOCOMW.2013.6824989"},{"key":"699_CR31","doi-asserted-by":"crossref","unstructured":"Chwalinski P, Belavkin R, Cheng X. Detection of application layer DDoS attacks with clustering and Bayes factors. In: 2013 IEEE international conference on systems, man, and cybernetics. IEEE; 2013. p. 156\u201361.","DOI":"10.1109\/SMC.2013.34"},{"key":"699_CR32","doi-asserted-by":"crossref","unstructured":"Liao Q, Li H, Kang S, Liu C. Feature extraction and construction of application layer DDoS attack based on user behavior. In: Proceedings of the 33rd Chinese control conference. IEEE; 2014. p. 5492\u20137.","DOI":"10.1109\/ChiCC.2014.6895878"},{"key":"699_CR33","doi-asserted-by":"crossref","unstructured":"Ye C, Zheng K, She C. Application layer DDoS detection using clustering analysis. In: Proceedings of 2012 2nd international conference on computer science and network technology. IEEE; 2012. p. 1038\u201341.","DOI":"10.1109\/ICCSNT.2012.6526103"},{"key":"699_CR34","doi-asserted-by":"crossref","unstructured":"Vijayalakshmi M, Shalinie SM, Pragash AA. IP traceback system for network and application layer attacks. In: 2012 international conference on recent trends in information technology. IEEE; 2012. p. 439\u201344.","DOI":"10.1109\/ICRTIT.2012.6206778"},{"key":"699_CR35","doi-asserted-by":"crossref","unstructured":"Dantas YG, Nigam V, Fonseca IE. A selective defense for application layer DDoS attacks. In: 2014 IEEE joint intelligence and security informatics conference. IEEE; 2014. p. 75\u201382.","DOI":"10.1109\/JISIC.2014.21"},{"key":"699_CR36","doi-asserted-by":"crossref","unstructured":"Yadav S, Selvakumar S. Detection of application layer DDoS attack by modeling user behavior using logistic regression. In: 2015 4th international conference on reliability, Infocom technologies and optimization (ICRITO) (trends and future directions). IEEE; 2015. p. 1\u20136.","DOI":"10.1109\/ICRITO.2015.7359289"},{"key":"699_CR37","doi-asserted-by":"crossref","unstructured":"Durcekova V, Schwartz L, Shahmehri N. Sophisticated denial of service attacks aimed at application layer. In: 2012 ELEKTRO. IEEE; 2012. p. 55\u201360.","DOI":"10.1109\/ELEKTRO.2012.6225571"},{"key":"699_CR38","doi-asserted-by":"crossref","unstructured":"Stevanovic D, Vlajic N. Application-layer DDoS in dynamic web-domains: building defenses against next-generation attack behavior. In: 2014 IEEE conference on communications and network security. IEEE; 2014. p. 490\u20131.","DOI":"10.1109\/CNS.2014.6997519"},{"key":"699_CR39","doi-asserted-by":"crossref","unstructured":"Devi SR, Yogesh P. An effective approach to counter application layer DDoS attacks. In: 2012 third international conference on computing, communication and networking technologies (ICCCNT\u201912). IEEE; 2012. p. 1\u20134.","DOI":"10.1109\/ICCCNT.2012.6395941"},{"key":"699_CR40","doi-asserted-by":"crossref","unstructured":"Wen S, Jia W, Zhou W, Zhou W, Xu C. CALD: surviving various application-layer DDoS attacks that mimic flash crowd. In: 2010 fourth international conference on network and system security. IEEE; 2010. p. 247\u201354.","DOI":"10.1109\/NSS.2010.69"},{"key":"699_CR41","doi-asserted-by":"crossref","unstructured":"Xu C, Zhao G, Xie G, Yu S. Detection on application layer DDoS using random walk model. In: 2014 IEEE international conference on communications (ICC). IEEE; 2014. p. 707\u201312.","DOI":"10.1109\/ICC.2014.6883402"},{"key":"699_CR42","doi-asserted-by":"crossref","unstructured":"Singh B, Kumar K, Bhandari A. Simulation study of application layer DDoS attack. In: 2015 international conference on green computing and internet of things (ICGCIoT). IEEE; 2015. p. 893\u20138.","DOI":"10.1109\/ICGCIoT.2015.7380589"},{"key":"699_CR43","doi-asserted-by":"crossref","unstructured":"Vlajic N, Slopek A. Performance and economies of bot-less application-layer DDoS attacks. In: The 9th international conference for internet technology and secured transactions (ICITST-2014). IEEE; 2014. p. 318\u201323.","DOI":"10.1109\/ICITST.2014.7038828"},{"key":"699_CR44","doi-asserted-by":"crossref","unstructured":"Stevanovic D, Vlajic N. Next generation application-layer DDoS defences: applying the concepts of outlier detection in data streams with concept drift. In: 2014 13th international conference on machine learning and applications. IEEE; 2014. p. 456\u201362.","DOI":"10.1109\/ICMLA.2014.80"},{"key":"699_CR45","volume-title":"All about Maude\u2014a high-performance logical framework: how to specify, program, and verify systems in rewriting logic","author":"M Clavel","year":"2007","unstructured":"Clavel M, Dur\u00e1n F, Eker S, Lincoln P, Mart\u00ed-Oliet N, Meseguer J, Talcott C. All about Maude\u2014a high-performance logical framework: how to specify, program, and verify systems in rewriting logic, vol. 4350. Berlin: Springer; 2007."},{"key":"699_CR46","doi-asserted-by":"crossref","unstructured":"Kemp C, Calvert C, Khoshgoftaar TM. Detection methods of slow read dos using full packet capture data. In: 2020 IEEE 21st international conference on information reuse and integration for data science (IRI). IEEE; 2020. p. 9\u201316.","DOI":"10.1109\/IRI49571.2020.00010"},{"key":"699_CR47","volume-title":"Python machine learning","author":"S Raschka","year":"2017","unstructured":"Raschka S, Mirjalili V. Python machine learning. 2nd ed. Birmingham: Packt Publishing; 2017.","edition":"2"},{"key":"699_CR48","unstructured":"Calvert C, Khoshgoftaar TM, Kemp C, Najafabadi MM. Detection of slowloris attacks using netflow traffic. In: 24th ISSAT international conference on reliability and quality in design, 2018. p. 191\u20136."},{"key":"699_CR49","unstructured":"OWASP. OWASP foundation. 2021. https:\/\/owasp.org\/."},{"key":"699_CR50","doi-asserted-by":"crossref","unstructured":"Kemp C, Calvert C, Khoshgoftaar T. Utilizing netflow data to detect slow read attacks. In: 2018 IEEE international conference on information reuse and integration (IRI). IEEE; 2018. p. 108\u201316.","DOI":"10.1109\/IRI.2018.00023"},{"key":"699_CR51","volume-title":"Data mining: practical machine learning tools and techniques","author":"IH Witten","year":"2016","unstructured":"Witten IH, Frank E, Hall MA, Pal CJ. Data mining: practical machine learning tools and techniques. Cambridge: Morgan Kaufmann; 2016."},{"key":"699_CR52","unstructured":"Lemos R. 3 steps to keep down security\u2019s false-positive workload. 2013. https:\/\/www.darkreading.com\/analytics\/security-monitoring\/3-steps-to-keep-down-securitys-false-positive-workload\/d\/d-id\/1140513."},{"key":"699_CR53","unstructured":"Infocyte. Cybersecurity 101: what you need to know about false positives and false negatives. 2021. https:\/\/www.infocyte.com\/blog\/2019\/02\/16\/cybersecurity-101-what-you-need-to-know-about-\/false-positives-and-false-negatives\/."},{"key":"699_CR54","unstructured":"Laerd. One-way ANOVA. 2021. https:\/\/statistics.laerd.com\/statistical-guides\/one-way-anova-statistical-guide-4.php."},{"key":"699_CR55","unstructured":"Liu H, Setiono R. A probabilistic approach to feature selection\u2014a filter solution. In: 13th international conference on machine learning; 1996. p. 319\u201327."},{"issue":"4","key":"699_CR56","first-page":"346","volume":"13","author":"B Surendiran","year":"2021","unstructured":"Surendiran B, Sreekanth P, Keerthi ESH, Praneetha M, Swetha D, Arulmurugaselvi N. Feature subset selection for cancer detection using various rank-based algorithms. Int J Med Eng Inform. 2021;13(4):346\u201357.","journal-title":"Int J Med Eng Inform"},{"key":"699_CR57","unstructured":"Roweis ST, Saul LK, Hinton GE. Global coordination of local linear models. In: Advances in neural information processing systems; 2002. p. 889\u201396."},{"issue":"Nov","key":"699_CR58","first-page":"2579","volume":"9","author":"Lvd Maaten","year":"2008","unstructured":"Maaten Lvd, Hinton G. Visualizing data using t-SNE. J Mach Learn Res. 2008;9(Nov):2579\u2013605.","journal-title":"J Mach Learn Res"}],"container-title":["Journal of Big Data"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-023-00699-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s40537-023-00699-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-023-00699-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,2,13]],"date-time":"2023-02-13T10:03:59Z","timestamp":1676282639000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofbigdata.springeropen.com\/articles\/10.1186\/s40537-023-00699-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,2,13]]},"references-count":58,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,12]]}},"alternative-id":["699"],"URL":"https:\/\/doi.org\/10.1186\/s40537-023-00699-3","relation":{},"ISSN":["2196-1115"],"issn-type":[{"value":"2196-1115","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,2,13]]},"assertion":[{"value":"16 June 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 February 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 February 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"The authors declare that they have no competing interests.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"22"}}