Pattern for Securing Web Application Under Threat of Uncontrolled Growth in the Number of Reserved Resources

The purpose of this article: development of a pattern for a web application in case of a threat of uncontrolled growth of the number of reserved resources as a result of incomplete user verification. Research method: analysis of the principles of DDoS attacks. Synthesis of DDoS attack scenarios for three types of attacks: transport layer, infrastructure layer, and application layer. The security scenario of a web application is chosen as the basis for the threat of an uncontrolled increase in the number of reserved resources as a result of incomplete user verification. A new protection mechanism has been proposed that provides redirection and verification of the user on a special set of tasks and further balancing of his request to the web application using the IP Hash method. The research was carried out by full-scale modeling of a Docker-based web application in containerization-enabled environments, its deployment and testing. Result: the analysis of the threat of uncontrolled growth in the number of reserved resources is carried out and the relevance of the problem of developing universal template security mechanisms called patterns is shown. In particular, the scenarios of DDoS attacks on web applications are considered. A scenario for ensuring the security of a web application is proposed when there is a threat of an uncontrolled increase in the number of reserved resources as a result of incomplete user verification. A microservice architecture has been built to ensure the security of a web application. A pattern has been developed for a web application in the event of a threat of uncontrolled growth in the number of reserved resources as a result of incomplete user verification based on microservices integrated into containers. As part of the research, a user verification service was developed in JavaScript, with Docker-based virtualization, and with an nginx load balancer. The protection mechanism is implemented as follows. Before entering the web application, the user is redirected to a page where a specific task is required: to solve a mathematical example, to recognize symbols in the right way, to recognize graphic objects in the right way. Upon successful completion of the tasks, the user is redirected to the web application, passing through one of the three load balancers using the IP Hash method. The program code of the user verification service has been developed, including codes of special methods and algorithms for the three tasks mentioned above. A web application security pattern based on Grafana k6 has been tested. The test program code has been developed.js with an implemented testing scenario that includes three stages with different load levels. Up to 20 virtual users participated in the test at the same time, with a gradual increase in workload. As a result of testing, not a single request failure was recorded, all 4816 requests were successful – this indicates the stable operation of the web application security pattern. Practical value: the practical value of the proposed solution includes a pattern for a web application under the threat of uncontrolled growth in the number of reserved resources as a result of incomplete user verification, which can be applied to a wide range of web applications.