Website Attack Detection via Header Information Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting Challenge Collapsar (CC) attacks on websites are inadequate, as they fail to accurately differentiate between legitimate traffic increases and CC attacks, leading to potential misjudgments and undetected attacks below specified thresholds.
Innovation Solution
A website attack detection method that calculates the information aggregation degree parameter, such as information entropy, for each field in a website access request header, determining if the parameter value or its variation exceeds preset ranges to identify a CC attack, thereby enabling targeted protection measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional threshold-based detection methods are used, then simple implementation is achieved, but detection accuracy deteriorates leading to misjudgments between legitimate traffic and CC attacks
Solution Approach 1:
The patent transforms the detection approach from using simple traffic volume thresholds to calculating information aggregation degree parameters (such as information entropy) for each header field. This parameter transformation enables more precise differentiation between legitimate traffic and CC attacks by measuring the concentration and distribution characteristics of request header information, thereby resolving the contradiction between implementation simplicity and detection accuracy.
2Loss of time
If traffic threshold methods are used, then quick detection is achieved, but reliability deteriorates causing false positives and negatives
Solution Approach 1:
The patent segments the HTTP request into multiple header fields (User-Agent, Accept, Referer, etc.) and calculates information aggregation degree parameters for each field independently. This segmentation allows the system to quickly assess multiple dimensions of request characteristics simultaneously, maintaining fast detection speed while improving reliability through multi-field analysis that captures the nuanced differences between legitimate and malicious traffic patterns.
3Measurement precision
If comprehensive analysis of request characteristics is performed, then detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent replaces complex pattern matching and behavioral analysis mechanisms with information-theoretic calculations (information entropy, aggregation degree). These mathematical formulations provide a computationally efficient way to quantify the distribution and concentration of header field values, achieving high detection accuracy through standardized mathematical operations that are less computationally intensive than traditional machine learning or signature-based approaches.
Data Source
AI summary
Embodiments of this application disclose a website attack detection and protection method and system performed by a computing device, applied to the field of information processing technologies. In the method in the embodiments, the computing device calculates a parameter value of an information aggregation degree parameter corresponding to each field included in a header of a request for accessing a website, and then determines, according to the parameter value or a variation degree of the parameter value of the information aggregation degree parameter of the field, whether the website suffers a Challenge Collapsar attack.