Analysis of the implementation specifics Slow HTTP- attacks allowed to allocate a set of features, based on which is possible to detect this type of attack. The model of the web- server's behavior when implementing Slow HTTP- attack was created. The model is based on Markov chains using the machine as a means of describing the web-server transitions between states. The formulary relations allowing to calculate the probability of transition of web-server into overload condition for known values of intensities Incoming and outgoing requests were derived. Definable relations allowing to calculate the transition to web-server overload condition using the method of generating functions were withdrawn.
Carlsson Anders, Duravkin IEvgen Vladimirovich, Loktionova Anastasya Sergeevna Analysis of realization and method of detecting low-intensity HTTP-attacks. Part 2. Method of detecting Slow HTTP attacks // Проблеми телекомунікацій, Vol. 2014, Issue 1, 2014, pp. 96-100

The analysis of realization features of low-intensity HTTP-attacks was performed. Three types of low intensity attacks were highlighted: Slowloris, Slow POST attack and Slow READ attack. Scenarios of each type of low-intensity attacks were described. Features of this type of attacks in comparison with low-level attacks such as "denial of service" were selected: they do not require a large Number of resources from the attacking machine, and they are difficult for the detection, since their parameters are similar to legitimate traffic. All three types of attacks have been implemented using the tool "slowhttptest". The web server Apache parameter by which can be realized these vulnerabilities were obtained. Different configurations of the server Apache, which exposed to attacks of this type, have been investigated. The basic parameters of the attacks, in which server Apache transforms into a state, where it cannot service requests have been allocated. For each type of attacks the characteristic features were highlighted. Parameters of http-request, which assume the detection of this type attacks highlighted. The analysis of mathematical tools of building the models for the systems for these types of attacks detection on the basis of the obtained parameters was performed.
Carlsson Anders, Duravkin Evgeny Vladimirovich, Loktionova Anastasya Sergeevna Analysis of realization and method of detecting low-intensity HTTP-attacks // Проблеми телекомунікацій, Vol. 2013, Issue 3, 2013, pp. 61-70