Modeling Browsing Behavior Analysis for Malicious Robot Detection in Distributed Denial of Service Attacks

Distributed denial of service (DDoS) attacks are one of the most important threats for E-commerce. Their main goal is to prevent the users from accessing to web sites and internet resources through excessive use of the resources. In these attacks, availability which is one of the elements of security is targeted. One of the ways to achieve this goal is to apply web robots by which the attackers design and carry out the DDoS attacks at application layer. Various methods have been used to distinguish between malicious and non-malicious web robots. One of the most popular methods in the recent years is data mining and machine learning. This method is based on extracting and selecting those features which are fit for web sessions via web server access log files and applying data mining algorithms. Considering the fact that the DDoS attacks are dynamic and customizable, in this research, an attempt is made to present a customizable dynamic defensive mechanism for detecting malicious web robots through the analysis of behaviors of their browsing. At the present study, features extraction was carried out based on the characteristics of DDoS attacks together with optimization of the previous methods to determine web sessions. Furthermore refining the extracted features and selecting a set of efficient features reduced the time required for building a model. As a consequence, the efficiency enhanced by two percent compared to the best similar study.