Intermediary Device Detecting Incomplete HTTP Headers

The patent applies preliminary action by detecting incomplete HTTP headers before the connection timeout period expires. The system monitors incoming packets and identifies when an HTTP header is incomplete, then proactively terminates the connection before it can consume excessive resources. This prevents the Slowloris attack mechanism from taking effect while still allowing legitimate connections to proceed normally.

The patent replaces the traditional time-based connection management mechanism with a packet-content-based detection mechanism. Instead of relying solely on timeout periods to manage connections, the system substitutes a method that inspects HTTP header completeness in incoming packets. This substitution allows for more precise differentiation between legitimate idle connections and attack connections, resolving the contradiction between maintaining connections and preventing resource exhaustion.

The patent applies partial action by implementing a hybrid approach that combines both time-based timeout monitoring and packet-content-based header completion detection. The system does not terminate connections solely on the basis of incomplete headers nor solely on timeout, but uses both criteria in combination. This partial application of termination criteria reduces false positives while maintaining effectiveness against Slowloris attacks.

The patent implements feedback mechanisms by continuously monitoring connection state and adjusting termination decisions based on accumulated packet information. The system tracks whether HTTP headers are complete or incomplete and uses this feedback to make informed decisions about connection termination. This feedback loop allows the system to distinguish between temporary packet delays and genuine attack patterns, maintaining reliability while preventing attacks.

The patent extracts the notification function from the connection termination process. Instead of sending RESET packets that provide feedback to the client about connection state, the system silently drops connections without notification. This extraction removes the information that attackers could use to adjust their timing, while the client's connection state is managed through alternative means such as connection timeout and reconnection logic.

The patent converts the potential harm of silent connection dropping (which could confuse clients) into a benefit by making the attack detection more effective. The absence of RESET packets prevents attackers from receiving feedback about their attack success, thereby converting what could be a negative user experience into an enhanced security measure that disrupts attack timing and detection evasion.