Overload control in QoS-aware web servers

The original C10K problem [1] studies how to provide reasonable service to 10,000 simultaneous clients or HTTP requests using a normal web server. We call the following problem the reverse C10K problem, or RC10K -- how to support 10,000 simultaneous outbound HTTP requests running on a web server. The RC10K problem can be found in scenarios like service orchestrations and server-side mashups. A server-side mashup needs to send several simultaneous HTTP requests to partner services for each inbound request. Many approaches to improving the performance and scalability of HTTP servers can be applied to tackle the original C10K problem. However, whether these approaches can tackle the reverse C10K problem needs to be verified. In this paper, we discuss the RC10K problem for server-side mashups, and propose a design that takes advantage of advanced I/O, multithreading, and event-driven programming. The results of analysis and experiments show that our design can reduce the resource requirements by almost one order of magnitude with the same performance provided, and it is promising to tackle the RC10K problem.

Until the development of HTTP request smuggling in 2005, individual HTTP requests were considered as independent entities and could not be split or merged. This is a security problem caused by inconsistent content length interpretation approach between web servers, or the web server is not fully implemented in accordance with the RFC standard. It is especially dangerous for web services with complex web architectures. It can route the victims to receive malicious responses, amplify the impact of certain low-threat vulnerabilities, steal user credentials, or bypass network devices’ defenses. However, since its concept and implementation are quite difficult to overcome, it is often ignored by many network administrators, making users who browse such websites vulnerable to the HTTP request smuggling attacks. This paper proposes a general solution to deal with various HTTP request smuggling attacks. A reverse proxy implemented by Flask validates and cleans dubious HTTP requests from the client side and ensures that the original requests comply with RFC standards. Therefore, the website administrators no longer need to configure complicated network settings or customize some open-source project codes to resist or minimize the risk of the HTTP request smuggling attacks. A series of experiments demonstrate that this method is effective and practical.

The absence of benchmarks for Web sites with dynamic content has been a major impediment to research in this area. We describe three benchmarks for evaluating the performance of Web sites with dynamic content. The benchmarks model three common types of dynamic content Web sites with widely varying application characteristics: an online bookstore, an auction site, and a bulletin board. For the online bookstore, we use the TPCW specification. For the auction site and the bulletin board, we provide our own specification, modeled after ebay.com and slahdot.org, respectively. For each benchmark we describe the design of the database and the interactions provided by the Web server. We have implemented these three benchmarks with a variety of methods for building dynamic-content applications, including PHP, Java servlets and EJB (Enterprise Java Beans). In all cases, we use commonly used open-source software. We also provide a client emulator that allows a dynamic content Web server to be driven with various workloads. Our implementations are available freely from our Web site for other researchers to use. These benchmarks can be used for research in dynamic Web and application server design. In this paper, we provide one example of such possible use, namely discovering the bottlenecks for applications in a particular server configuration. Other possible uses include studies of clustering and caching for dynamic content, comparison of different application implementation methods, and studying the effect of different workload characteristics on the performance of servers. With these benchmarks we hope to provide a common reference point for studies in these areas.

Many factors can prevent a Gigabit Ethernet network interface card (NIC) from achieving line rate in a modern web server. In fact, the various commercially available NICs have different performance characteristics that lead to throughput differences for actual web servers. For example, Figure 1 shows the performance achieved by the thttpd web server for client traces extracted from the Rice University computer science department (CS), a NASA web site (NASA), and the 1998 soccer World Cup tournament (World Cup). The latter two traces are available from the Internet Traffic Archive (http://ita.ee.lbl.gov/). The server system tested includes an AMD Athlon 2600+ XP processor running the FreeBSD 4.7 operating system, 2 GB of DDR SDRAM, a 64-bit/66 MHz PCI bus, and a single 40 GB IDE disk (none of the workloads are disk intensive). The tested systems differ only in their NIC, with the Intel Pro-1000/MT Server and Desktop, Alteon AceNIC with parallelized firmware [2], Netgear GA622T, 3Com 3C996B, and Alteon AceNIC with released firmware arranged from left to right. There are substantial performance differences across the NICs in the web environment, as the fastest NIC consistently achieves 40–60% more throughput than the slowest. A web server interacts with the network in two primary ways: receiving client HTTP requests and sending HTTP responses. Requests are typically quite small, on the order of 200 bytes of ASCII text, while responses vary from empty files to several hundred megabytes. Since web clients and servers communicate using TCP, the server must acknowledge requests, leading to minimum-sized (64-byte) Ethernet frames. Response data must be segmented and encapsulated in Ethernet frames, which allow up to 1460 bytes of TCP content in a maximum-sized (1518-byte) frame. Then, those segments are sent out according to TCP flow control policies based on the receipt of acknowledgments. A high-performance server NIC must thus support data volumes dominated by sends of large

HTTP low and slow DoS is a kind of attack wherein an attacker sends a stream of very slow HTTP requests to a web server. These slow HTTP requests are aimed at specific applications or server resources. By sending HTTP requests very slowly, these attacks waste the server’s resources as the server has to wait for the slow HTTP requests to be completed. HTTP low and slow DoS attacks are primarily used against thread-based web servers like Apache and IIS. By sending very slow requests, these attacks tie up the server threads. This results in a Denial of service for other legitimate users. Since low and slow DoS attacks do not require flooding or sending a large number of HTTP requests, they are not easily detected. Traditional network layer tools cannot detect low and slow DoS attacks and other mitigation and detection strategies are required for the detection of low and slow DoS attacks. In this paper, we propose an LSTM deep learning-based approach for detecting HTTP DoS attacks. The proposed study was conducted on the CIC DoS dataset and a synthetically generated dataset and achieved an impressive accuracy of 0.99.

A new approach to web server attacks detection based on the statistical analysis of HTTP requests and principles of immunocomputing is proposed in the paper. We use a set of legitimate HTTP requests as training data. Each request is represented as its byte frequency distribution. Immunocomputing is used to calculate the binding energy between the training data and sampled HTTP requests. If the binding energy is less than some threshold, an alarm will be triggered. Our approach has been tested with the DARPA data set and the data set collected from the vulnerable web server. We have shown that our approach detects various attacks with a high degree of accuracy.

In recent years there is a rapid increase of traffic to a given web server within a short time as the number of Internet users increases, and such a phenomenon is called a flash crowd. Once flash crowds occur in the web server, a response rate decreases or the web server may crash as the load increases. We propose a load reduction system, which prevents excessive accesses and stably delivers content without enhancing the performance of the web server even when flash crowds occur. In the proposed system, a proxy server detects flash crowds by monitoring the number of requests and changes a content delivery system. To limit accesses to the web server, the proxy server redirects a request to another client that holds the content in the cache when flash crowds occur. We also propose a content delivery system that uses a tree construction to reduce the client load. Moreover, its efficacy is shown through simulations.

Web services usually compose to workflows to satisfy complex demands. End-to-end execution time is widely seen as a key quality metric of web service workflows. That will be affected by many factors. This paper focuses on impacts of an important factor -- scheduling algorithm in services -- on collective end-to-end time characteristics of a set of web service workflows. We develop a novel simulator, in which workflows are simulated to execute. Impacts of different scheduling algorithms are evaluated through comparing simulation results. Simulation results indicate that maximal and average end-toend execution time of most workflows when using "earliest deadline first" (EDF) scheduling algorithm in services is significant shorter than that when using widely used "first in, first out" (FIFO) scheduling algorithm.

High-performance Web servers are essential to meet the growing demands of the Internet and large-scale intranets. Satisfying these demands requires a thorough understanding of key factors affecting Web server performance. This paper presents empirical analysis illustrating how dynamic and static adaptivity can enhance Web server performance. Two research contributions support this conclusion. First, the paper presents results from a comprehensive empirical study of Web servers (such as Apache, Netscape Enterprise, PHTTPD, Zeus, and JAWS) over high-speed ATM networks. This study illustrates their relative performance and precisely pinpoints the server design choices that cause performance bottlenecks. Once network and disk I/O overheads are reduced to negligible constant factors, the main determinants of Web server performance are its protocol processing path and concurrency strategy. Moreover no single strategy performs optimally for all load conditions and traffic types. Second, we describe the design techniques and optimizations used to develop JAWS, our high-performance adaptive Web server. JAWS is an object-oriented Web server that was explicitly designed to alleviate the performance bottlenecks we identified in existing Web servers. The performance optimizations used in JAWS include adaptive prespawned threading, fixed headers, cached date processing, and file caching. In addition, JAWS uses a novel software architecture that substantially improves its portability and flexibility, relative to other Web servers.

Simple SummaryThe OSov web server incorporates gene expression profiles with clinical risk factors to estimate the ovarian cancers patients’ survival, and provides a tool for multiple analysis, such as forest-plot, uni/multi-variate survival analysis, Kaplan-Meier plot and nomogram construction.Ovarian cancer is one of the most aggressive and highly lethal gynecological cancers. The purpose of our study is to build a free prognostic web server to help researchers discover potential prognostic biomarkers by integrating gene expression profiling data and clinical follow-up information of ovarian cancer. We construct a prognostic web server OSov (Online consensus Survival analysis for Ovarian cancer) based on RNA expression profiles. OSov is a user-friendly web server which could present a Kaplan–Meier plot, forest plot, nomogram and survival summary table of queried genes in each individual cohort to evaluate the prognostic potency of each queried gene. To assess the performance of OSov web server, 163 previously published prognostic biomarkers of ovarian cancer were tested and 72% of them had their prognostic values confirmed in OSov. It is a free and valuable prognostic web server to screen and assess survival-associated biomarkers for ovarian cancer.

With the growing importance of the World Wide Web, Web managers are facing the problem of how to accurately measure the performance of their Web servers. This paper addresses this problem by introducing a traffic generator which is developed by using the Java language. The generator generates Web workload by using an analytic model which models the arrivals at the user level. It is both self-scaling and self-configuring, meaning that it can scale the traffic to any intensities and configure the arrival characteristics to conform to those of any specific Web site. The latter is done by analyzing a site's access log for adjusting the model parameters being used during traffic generation. In contrast to other traffic generator being used in common Web benchmark software, the real content of the target Web server is used as the testing file set instead of just using a reduced standard file set. Experimental results on using the generator to test two Web servers are also presented. The results show that the generator is both functional and useful to measure the performance of Web servers under real situations.

Today, in the field of computer networks, new services have been developed on the Internet or intranets, including the mail server, database management, sounds, videos and the web server itself Apache. The number of solutions for this server is therefore growing continuously, these services are becoming more and more complex and expensive, without being able to fulfill the needs of the users. The absence of benchmarks for websites with dynamic content is the major obstacle to research in this area. These users place high demands on the speed of access to information on the Internet. This is why the performance of the web server is critically important. Several factors influence performance, such as server execution speed, network saturation on the internet or intranet, increased response time, and throughputs. By measuring these factors, we propose a performance evaluation strategy for servers that allows us to determine the actual performance of different servers in terms of user satisfaction. Furthermore, we identified performance characteristics such as throughput, resource utilization, and response time of a system through measurement and modeling by simulation. Finally, we present a simple queue model of an Apache web server, which reasonably represents the behavior of a saturated web server using the Simulink model in Matlab (Matrix Laboratory) and also incorporates sporadic incoming traffic. We obtain server performance metrics such as average response time and throughput through simulations. Compared to other models, our model is conceptually straightforward. The model has been validated through measurements and simulations during the tests that we conducted.

In this study, it is aimed to reduce False-Alarm levels and increase the correct detection rate in order to reduce this uncertainty. Within the scope of the study, 13157 SQLi and XSS type malicious and 10000 normal HTTP Requests were used. All HTTP requests were received from the same web server, and it was observed that normal requests and malicious requests were close to each other. In this study, a novel approach is presented via both digitization and expressing the data with words in the data preprocessing stages. LSTM, MLP, CNN, GNB, SVM, KNN, DT, RF algorithms were used for classification and the results were evaluated with accuracy, precision, recall and F1-score metrics. As a contribution of this study, we can clearly express the following inferences. Each payload even if it seems different which has the same impact maybe that we can clearly view after the preprocessing phase. After preprocessing we are calculating euclidean distances which brings and gives us the relativity between expressions. When we put this relativity as an entry data to machine learning and/or deep learning models, perhaps we can understand the benign request or the attack vector difference.

This paper introduces a mobile real-time video system which is different from other existing real-time video system that is mainly based on wired computers. The system proposed in paper is basically designed to enable users under wireless circumstances to publish what they are capturing with their mobile devices and also watch what others are capturing. The system mainly contains mobile devices with a Flex client application on them, a media server which handles live streams using RTMP (Real-Time Messaging Protocol), and a web server which used to deal with HTTP requests.

At present, Web applications and HTTP requests on the Internet are so explosively increasing that a large number of hot Web sites frequently confront with problems of server overloading. And how to provide various web services with high-level quality and satisfactory performance for Web clients has become one of the most urgent points we concern. In order to smoothly solve these problems, we proposed a Web QoS control model based on dynamically reallocating resource on Web server. Facilitated by adopting reflective policy, this model could monitor the real-time state of server resources, schedule and reallocate these resources to satisfy the different client demands in practice. Moreover, this model could utilize a multiple of pre-designed policies that classify HTTP requests based on dynamic admission control scheme and distribute server resource based on dynamic resource reallocation scheme. And we conduct evaluation experiments and compare the QoS performance of this model with the basic best-effort model in IIS6.0. Evaluation results demonstrate our model could significantly reduce response time, warrant stability and reliability when requests exceed the capacity of a Web server.