HTTP Flood DDoS Attack Characterization via Dynamic Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for mitigating HTTP flood DDoS attacks are ineffective in distinguishing between legitimate and malicious requests, especially when attackers use tools that generate 'legitimate-looking' requests with randomization, leading to high false positive and false negative rates, and are limited to in-line traffic analysis during peacetime, making them unsuitable for out-of-path processing.
Innovation Solution
A method and system that generate dynamic applicative signatures by analyzing application-layer requests during an ongoing attack, characterizing each request based on frequent attributes, and triggering mitigation actions, without requiring a normal baseline or threshold computation, allowing for real-time differentiation between legitimate and attacker traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current solutions use in-line traffic analysis during peacetime to establish baselines, then they can detect normal traffic patterns, but they fail to accurately distinguish malicious requests from legitimate ones during HTTP flood attacks
Solution Approach 1:
Instead of establishing a baseline of normal traffic and detecting deviations, the patent inverts the approach by directly characterizing attack traffic patterns during the attack. The system analyzes incoming requests during the HTTP flood to identify frequent attributes that define the attack, rather than comparing against a pre-established peacetime baseline. This inversion allows accurate identification of malicious requests without being misled by attackers who randomize their traffic to appear legitimate.
Solution Approach 2:
The patent implements dynamic signature generation that adapts in real-time during the attack. The characterization system continuously analyzes incoming requests and updates the attack signature based on frequently observed attributes. This dynamic approach allows the system to track evolving attack patterns and maintain accuracy even as attackers modify their tactics, unlike static baselines that become obsolete during active attacks.
2Adaptability or versatility
If solutions require normal baseline computation and threshold settings, then they can establish a reference for attack detection, but they cannot be applied for out-of-path processing during ongoing attacks
Solution Approach 1:
The patent performs preliminary characterization of attack traffic by analyzing the first batch of incoming requests during the attack to generate an initial signature quickly. This preliminary action occurs within seconds of attack detection, allowing the system to be operational almost immediately without requiring lengthy peacetime baseline collection. The system prepares the characterization mechanism in advance so it can activate and start generating signatures as soon as attack traffic arrives.
Solution Approach 2:
The characterization system is self-sufficient during the attack, generating its own signatures directly from the incoming malicious traffic without needing external baseline data or manual threshold configuration. The system serves itself by automatically identifying attack patterns from the traffic it receives, eliminating the need for separate baseline computation phases and enabling immediate out-of-path deployment during ongoing attacks.
3Device complexity
If attackers use tools that generate legitimate-looking requests with randomization, then they can evade traditional anti-DoS mitigation, but it becomes extremely difficult to characterize the attack patterns
Solution Approach 1:
The patent changes the parameters used for characterization from content-based features (URLs, headers, payloads) to structural and behavioral features (request timing patterns, method distributions, path structures). By shifting to these different parameters that are less susceptible to randomization, the system can identify attack patterns even when attackers vary the content of their requests. The frequent attribute analysis focuses on consistent structural elements that attackers cannot easily randomize without breaking their attack effectiveness.
Data Source
AI summary
A method for characterizing application layer denial-of-service (DDoS) attacks comprises generating a plurality of dynamic applicative signatures by analyzing at the application layer application layer requests received during an on-going DDoS attack, a dynamic applicative signature characterizing each received request based on frequent application layer attributes appearing in the received requests, wherein the requests are represented as a set of paraphrases, each paraphrase representing a specific aspect of a request's structure, the frequent application layer attributes being determined based on frequency of paraphrases in the set; characterizing each of the received requests based on one of the dynamic applicative signatures, the characterization providing an indication for each request whether a request is generated by an attack tool executing the on-going DDoS attack; and causing a mitigation action on the received request generated by the attack tool based on the generated dynamic applicative signature.