A hands-on gaze on HTTP/3 security through the lens of HTTP/2 and a public dataset
Following QUIC protocol ratification on May 2021, the third major version of
the Hypertext Transfer Protocol, namely HTTP/3, was published around one year
later in RFC 9114. In light of these consequential advancements, the current
work aspires to provide a full-blown coverage of the following issues, which to
our knowledge have received feeble or no attention in the literature so far.
First, we provide a complete review of attacks against HTTP/2, and elaborate on
if and in which way they can be migrated to HTTP/3. Second, through the
creation of a testbed comprising the at present six most popular HTTP/3-enabled
servers, we examine the effectiveness of a quartet of attacks, either stemming
directly from the HTTP/2 relevant literature or being entirely new. This
scrutiny led to the assignment of at least one CVE ID with a critical base
score by MITRE. No less important, by capitalizing on a realistic, abundant in
devices testbed, we compiled a voluminous, labeled corpus containing traces of
ten diverse attacks against HTTP and QUIC services. An initial evaluation of
the dataset mainly by means of machine learning techniques is included as well.
Given that the 30 GB dataset is made available in both pcap and CSV formats,
forthcoming research can easily take advantage of any subset of features,
contingent upon the specific network topology and configuration.