Mitigation of HTTP Flood DDoS Attack in Application Layer Using Machine Learning and Isolation Forest

Abstract

Distributed Denial of Service (DDoS) attacks, specifically HTTP flood DDoS attacks, have become a constant and substantial threat to online companies and critical services due to the growing popularity of web-based applications and technology. HTTP flood DDoS attacks inundate web servers with an overwhelming volume of seemingly legitimate HTTP requests emanating from compromised devices or botnets. Traditional DDoS mitigation approaches, often reliant on rate limiting and traffic filtering, struggle to discern between legitimate and malicious traffic, leading to service degradation or downtime. Methods for identifying abnormal HTTP traffic behaviour involve gathering and preprocessing data, generating features, and developing Isolation Forest algorithms. The power of this method comes from its ability to detect anomalies in real-time, making it easy to identify and block HTTP flood DDoS attack traffic. As such, this is a significant feature of the methodology. In tandem with Isolation Forest, machine learning empowers the system to adapt proactively to emerging attack vectors, enhancing its resilience in the face of evolving threats. This research presents a novel approach to fortify the application layer against HTTP flood DDoS attacks by utilizing machine learning techniques, with a central focus on the Isolation Forest algorithm. The experimental validation results show that the proposed framework can effectively recognize and mitigate HTTP flood DDoS attacks with minimal service interruption and false positives. The tests were run on benchmark datasets from the KDD Cup 1999 and the NSL-KDD, and the results stated here enhance the basis for the proposed model and enable the research to achieve its objective.