Empirical chaos-driven approach for cloud resilience and scalability under HTTP DDoS attacks

Abstract Cloud-native applications are increasingly vulnerable to high-traffic HTTP flood attacks, which can overwhelm scalability mechanisms and significantly degrade service availability. Traditional mitigation strategies focus on securing traffic filtering, detecting, and mitigating HTTP DDoS attacks. However, these strategies overlook architectural approaches and resilience through scalable mechanisms. This study presents an empirical evaluation of cloud-native application resilience and scalability under HTTP DDoS attacks, applying chaos engineering principles. We conducted extensive controlled HTTP flood attack experiments totalling over 80 hours within Amazon Web Services (AWS) infrastructure, generating more than 10 million HTTP requests. We systematically evaluated and compared four scaling and resilience mechanisms: Default scaling, Warm-up scaling, 2-Desired capacity scaling, and virtual private cloud (VPC)-based scaling. The results were analysed both technically and statistically. We leveraged native scaling and security mechanisms offered by cloud providers, including auto-scaling, application load balancers, security groups, and multi-availability zone deployment. Our findings demonstrate that while all mechanisms tend to have similar behaviour under low-load circumstances, they have different behaviour under high-intensity attacks. The VPC-based scalability mechanism demonstrates improved performance by reducing the failure rate by 12% compared to the default scaling mechanism, enhancing availability while reducing the observed total request volume by approximately 60% relative to the default configuration under the evaluated HTTP flood conditions, while preventing over-provisioning costs. This work contributes to a broader perspective on HTTP DDoS mitigation by highlighting scalability mechanisms as a resilience-by-design approach, complementing traditional security-based defences. These play a critical role in sustaining cloud service dependability under HTTP DDoS attack conditions. The work offers evidence-based guidance that helps cloud practitioners optimise scalability and resilience mechanisms. It also provides cloud-native architects with practical insights to prepare for HTTP flood attacks and to avoid autoscaling configurations that may incur unnecessary costs. Future research should explore predictive auto-scaling and real-time adaptive mechanisms for handling HTTP floods in cloud-native applications.