This work investigates the detection and mitigation methods that aim at Slow Denial of Service attacks. The paper focuses mainly on Slowloris and Slow Read DoS attacks which are resistant to classical DoS detection and mitigation techniques. The proposed approach consists of the detection phase and mitigation phase. Detection methods are based on network traffic analysis and anomalous traffic monitoring. Furthermore, if an attack is recognized then classified malicious traffic is blocked and web server resources are released. The proposed methods are implemented and consolidated into an intrusion prevention system software. The implemented system is tested and obtained results prove its functionality.

In today’s world, the volume of cyber attacks grows every year. These attacks can cause many people or companies high financial losses or loss of private data. One of the most common types of attack on the Internet is a DoS (denial-of-service) attack, which, despite its simplicity, can cause catastrophic consequences. A slow DoS attack attempts to make the Internet service unavailable to users. Due to the small data flows, these attacks are very similar to legitimate users with a slow Internet connection. Accurate detection of these attacks is one of the biggest challenges in cybersecurity. In this paper, we implemented our proposal of eleven major and most dangerous slow DoS attacks and introduced an advanced attack generator for testing vulnerabilities of protocols, servers, and services. The main motivation for this research was the absence of a similarly comprehensive generator for testing slow DoS vulnerabilities in network systems. We built an experimental environment for testing our generator, and then we performed a security analysis of the five most used web servers. Based on the discovered vulnerabilities, we also discuss preventive and detection techniques to mitigate the attacks. In future research, our generator can be used for testing slow DoS security vulnerabilities and increasing the level of cyber security of various network systems.

Cybersecurity has become important, especially during the last decade. The significant growth of information technologies, internet of things, and digitalization in general, increased the interest in cybersecurity professionals significantly. While the demand for cybersecurity professionals is high, there is a significant shortage of these professionals due to the very diverse landscape of knowledge and the complex curriculum accreditation process. In this article, we introduce a novel AI-driven mapping and optimization solution enabling cybersecurity curriculum development. Our solution leverages machine learning and integer linear programming optimization, offering an automated, intuitive, and user-friendly approach. It is designed to align with the European Cybersecurity Skills Framework (ECSF) released by the European Union Agency for Cybersecurity (ENISA) in 2022. Notably, our innovative mapping methodology enables the seamless adaptation of ECSF to existing curricula and addresses evolving industry needs and trend. We conduct a case study using the university curriculum from Brno University of Technology in the Czech Republic to showcase the efficacy of our approach. The results demonstrate the extent of curriculum coverage according to ECSF profiles and the optimization progress achieved through our methodology.

This work investigates the optimization and usability of slow Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks in computer networks. This paper focuses on Slowloris, Slow POST, and Slow Read attack. The reader is introduced to the principles and detection issues of these attacks, together with a closer look at the design of an advanced slow DoS attack generator. This paper also presents experimental testing of a proposed generator. The test scenarios are close to real attack cases, including distributed attacks. The proposed generator is applicable for future research or improvement of detection systems and webserver security modules.

This paper describes a system for generating messages according to the sets of standards IEC 60870-6 (ICCP/TASE.2). Particular attention is paid to messages exchanged between the power grid nodes and control centers. We discussed the typical grid network architecture and communication strategies. On this basis, we proposed and implemented the software to simulate real TASE.2 system operation in two different communication modes. The architecture of the designed generator is described in detail, including methods to ensure high-performance and scalability. The system supports the cryptographic security of the generated traffic. The proposed generator allows users to perform the complex testing and verification of the TASE.2 network nodes configuration, including the testing of connection to the related system such as message brokers and analytics tools. Due to the high performance and scalability of the proposed generator, it is possible to perform the stress testing of these systems.