Dynamic Applicative Signatures for HTTP Flood Attack Characterization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for mitigating HTTP flood DDoS attacks are inadequate due to their reliance on establishing a normal baseline during peacetime, which fails when attacks generate random requests, leading to high false positive and false negative rates.
Innovation Solution
A system that determines various attributes of incoming requests during a DDoS attack, clusters these attributes based on their values, generates dynamic applicative signatures characterizing the operation of application layer flood attack tools, and matches these signatures to incoming requests to trigger mitigation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If baseline-based mitigation is used during peacetime, then mitigation decisions can be made based on normal traffic patterns, but it fails when attacks generate random requests leading to high false positive and false negative rates
Solution Approach 1:
The system dynamically adapts its detection approach by switching from baseline-based static thresholds to real-time clustering analysis. During attacks with random patterns, the system activates dynamic signature generation that adapts to the current traffic characteristics, allowing it to handle both normal traffic and random attack patterns effectively.
Solution Approach 2:
The system changes its operational parameters based on attack detection. When random attack patterns are detected, it transitions from using fixed baseline thresholds to using dynamically generated signatures based on real-time clustering of request attributes, thereby adapting to the changing attack characteristics.
2Measurement precision
If traditional baseline computation is performed, then normal traffic patterns can be established, but it cannot effectively characterize attacks with randomized requests
Solution Approach 1:
Instead of relying on pre-established baselines that may not match random attack patterns, the system creates dynamic copies of attack signatures by clustering request attributes in real-time. This allows the system to characterize and detect randomized attacks by copying their actual patterns as they occur.
Solution Approach 2:
The system performs preliminary clustering analysis on request attributes to generate dynamic signatures before making mitigation decisions. This preliminary action of characterizing the actual attack patterns enables effective detection even when attacks are highly randomized.
3Ease of manufacture
If simple mitigation rules are applied, then implementation is straightforward, but they cannot accurately distinguish legitimate requests from malicious requests
Solution Approach 1:
The system segments request analysis into multiple attributes (method, path, headers, parameters) and clusters each attribute separately. This segmentation allows for more precise characterization while maintaining implementation feasibility through modular processing of individual attribute types.
Solution Approach 2:
The clustering-based signature generation system serves multiple functions: it characterizes attack patterns, generates dynamic signatures, and enables accurate distinction between legitimate and malicious requests. This universal approach replaces multiple specialized rules with a single flexible mechanism.
Data Source
AI summary
A method of characterization of requests using dynamic applicative signatures. The method comprises determining a plurality of different attributes of requests received during an on-going DDoS attack; clustering at least one attribute of the plurality of different attributes, wherein the clustering is based on values of the plurality of different attributes; obtaining at least one dynamic applicative signature characterizing operation of an application layer flood attack tool; matching the cluster of the at least one attribute to each of the at least one obtained dynamic applicative signature; and causing a mitigation action when there is a match to the at least one obtained dynamic applicative signature.