The H23Q Dataset
This is a voluminous, labeled 802.3 corpus containing traces of ten diverse attacks against HTTP/2, HTTP/3, and QUIC services. It contains modern attacks, including HTTP/3-oriented ones. It is available in pcap and CSV formats. Given that the 30 GB dataset is made available in both pcap and CSV formats. Note that this is an 802.3 dataset. H23Q can be downloaded from the download tab. Publication: E. Chatzoglou, V. Kouliaridis, G. Kambourakis, G. Karopoulos and S. Gritzalis, "A hands-on gaze on HTTP/3 security through the lens of HTTP/2 and a public dataset", arXiv, 2022, doi: 10.48550/ARXIV.2208.06722.
Testbed
As shown in the below figure, the testbed for the creation of H23Q comprised 6 different HTTP/3-enabled servers, which run on the Azure cloud infrastructure. The clients were operated from three different subnetworks. The first comprised 6 clients, the second three, and the last four, with one of them operated by the attacker. To replicate real-life traffic scenarios, two of the public network interfaces (DSL routers), changed their public (routable) IP address during the recording process. This means that some attacks contain different public IP addresses for the same clients.
Attacks
H23Q comprises 60 pcap files, i.e., 10 attacks × 6 servers. Each attack against a server was performed following the order: OpenLiteSpeed, Caddy, NGINX, IIS, Cloudflare, and H2O. The included attacks are as follows (each attack is detailed in the corresponding paper).
- HTTP3-flood
- Fuzzing
- HTTP3-loris
- HTTP3-stream
- QUIC-flood
- QUIC-loris
- QUIC-enc
- HTTP-smuggling
- HTTP/2-concurrent
- HTTP/2-pause
Signature of Attacks
Indicatively, the below figures depict the signatures of two assaults, namely, a HTTP-flood against Cloudflare and a QUIC-flood against all the 6 servers.
Analysis through Machine Learning
We performed a preliminary evaluation of H23Q through machine learning techniques. Initially, a large number of features (199) were extracted from the pcap files. As shown in the below table, from this initial set of features, we cherry-picked less than half of them, i.e., a total of 46 features.
The H23Q evaluation process considered both shallow (Decision Trees, LightGBM, Bagging) and DNN (Multi-layer Perceptron, Denoising stacked Autoencoders, and TextCNN) analysis. The dataset was analyzed in a 60/40% fashion for the training and test sets, respectively. The stratified split scheme was used.
