Anzeige
Erschienen in:
2018 | OriginalPaper | Buchkapitel
H\(_{2}\)DoS: An Application-Layer DoS Attack Towards HTTP/2 Protocol
verfasst von : Xiang Ling, Chunming Wu, Shouling Ji, Meng Han
Erschienen in: Security and Privacy in Communication Networks
Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.
Wählen Sie Textabschnitte aus um mit Künstlicher Intelligenz passenden Patente zu finden. powered by
Markieren Sie Textabschnitte, um KI-gestützt weitere passende Inhalte zu finden. powered by
Abstract
HTTP/2, as the latest version of application layer protocol, is experiencing an exponentially increasing adoption by both servers and browsers. Due to the new features introduced by HTTP/2, many security threats emerge in the deployment of HTTP/2. In this paper, we focus on application-layer DoS attacks in HTTP/2 and present a novel H\(_{2}\)DoS attack that exploits multiplexing and flow-control mechanisms of HTTP/2. We first perform a large-scale measurement to investigate the deployment of HTTP/2. Then, based on measurement results, we test H\(_{2}\)DoS under a general experimental setting, where the server-side HTTP/2 implementation is nginx. Our comprehensive tests demonstrate both the feasibility and severity of H\(_{2}\)DoS attack. We find that H\(_{2}\)DoS attack results in completely denying requests from legitimate clients and has severe impacts on victim servers. Our work underscores the emerging security threats arise in HTTP/2, which has significant reference value to other researchers and the security development of HTTP/2.