Rampart: Protecting Web Applications from CPU-Exhaustion Denial-of-Service Attacks

on YouTube ↗24m

" summary

Rampart defends PHP web applications against CPU-exhaustion DoS attacks by combining statistical detection with function-level program profiling inside the PHP Zend engine. It automatically synthesizes, deploys, and adaptively updates filters to block offending requests without modifying application source code. The implementation is evaluated on WordPress and Drupal, showing low overhead and low false positive/negative rates against real-world and synthetic attacks.

AI-written summary · about

" chapters (20)

1. 0:00Start
2. 0:30Outline
3. 1:24Distributed DoS (DDoS) Attacks
4. 2:24Low-volume Sophisticated DoS Attacks
5. 3:03CVE-2014-9034
6. 4:27Goals
7. 4:47Threat Model
8. 5:38Approach
9. 6:21Web Application CPU Usage Modeling
10. 11:14CPU-Exhaustion Dos Attack Detection (Cont.)
11. 13:07Probabilisitic Request Termination
12. 14:23CPU-Exhaustion DOS Attack Blocking
13. 15:37The Exploratory Algorithm
14. 16:56Performance Optimizations
15. 17:27Implementation
16. 17:58Setup
17. 19:28Performance Measurements (Cont.)
18. 21:02Performance Degradation Caused by Attacks (Cont.)
19. 21:29Effectiveness of Rampart (Cont.)
20. 22:57Summary

" related talks

• 29mRack::Attack: Protect your app with this one weird gem!Aaron Suggs · RailsConf 2014
• 47mReversing Engineering a Web Application - For Fun, Behavior & WAF DetectionRodrigo Montoro · OWASP AppSecUSA 2014
• 42mRunning at 99% Surviging an Application DoSRyan Huber · AppSec California 2014
• 40mModern Web Application Defense with OWASP ToolsFrank Kim · OWASP AppSecUSA 2014
• 43mPHP Security, RedefinedChris Cornutt · AppSecUSA 2015
• 52mPractical Security in Web ApplicationsChris Holland · International PHP Conference Spring 2019
• 40mWeb Application Firewalls: Analysis of Detection LogicVladimir Ivanov · Black Hat USA 2016
• 35mComprehensive protection for Infrastructure and Web AppsLukasz Karwacki · Conf42 DevSecOps 2024