CC Attack Detection Using Request Correlation Ratio
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting and defending against Challenge Collapsar (CC) attacks suffer from long lagging times and high false rates, as they struggle to accurately differentiate between normal and attack traffic, often misidentifying peak-hour access as an attack.
Innovation Solution
The method involves recording and comparing the number of requests for a webpage and its related requests within a preset time interval, determining if the ratio of (m−n)/m exceeds a threshold, where m is the total number of requests and n is the number of related requests, to identify a CC attack, and redirecting users to defend against it.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If the ratio of request messages to response messages is used to detect CC attacks, then the detection method is simple to implement, but the detection accuracy is low and false rate is high
Solution Approach 1:
The patent changes the detection parameter from simple request-response ratio to a composite metric considering request frequency, response frequency, and their temporal correlation. This transforms the detection approach from single-parameter threshold comparison to multi-parameter joint analysis, improving detection accuracy while maintaining implementation feasibility through structured data collection and comparison.
2Ease of manufacture
If the request-response message ratio method is used, then the implementation is straightforward, but the detection lagging time is long
Solution Approach 1:
The patent implements preliminary action by continuously monitoring and recording request and response messages in real-time, maintaining a running count of message frequencies. This allows the system to detect attacks immediately when abnormal patterns emerge, eliminating the detection lag caused by waiting for significant ratio changes to accumulate.
Solution Approach 2:
The system establishes continuous feedback loops by constantly comparing current request-response frequencies against historical baselines and threshold values. When deviations exceed predefined thresholds, the system immediately triggers detection alerts, creating a real-time responsive mechanism that reduces detection lagging time while maintaining implementation simplicity.
3Use of energy by moving object
If traditional CC attack detection methods are used, then the system resources consumption is low, but the false rate increases due to misidentifying normal peak-hour access as attacks
Solution Approach 1:
The patent applies local quality by analyzing the specific characteristics of different traffic patterns in their local contexts. Instead of applying a uniform detection threshold to all traffic, the system evaluates request-response correlations locally for each time period and traffic type, allowing normal peak-hour access patterns to be distinguished from actual attacks based on their unique local characteristics.
Solution Approach 2:
The detection system implements dynamics by adapting its analysis to changing traffic conditions. It dynamically adjusts detection parameters based on historical data and current traffic patterns, enabling the system to differentiate between legitimate high-traffic periods and actual attacks. This dynamic approach reduces false positives while maintaining low resource consumption through efficient pattern recognition.
Data Source
AI summary
A method for detecting and defending against a CC attack is disclosed, which comprises the following steps of: recording the number of times m of requests for a webpage and the number of times n of related requests for the webpage within a preset time interval if a user's request of accessing the webpage is a dynamic webpage request; and determining that the webpage is subjected to a CC attack if a value (m−n)/m is greater than or equal to a preset threshold. A corresponding apparatus is further disclosed. The method and the apparatus for detecting and defending against a CC attack of the present disclosure can accurately detect and defend against the CC attack.