Intermediary Window Probe Mechanism for Malicious TCP Resource Exhaustion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Transport layer protocols, such as TCP, face issues with resource utilization due to malicious receivers that set zero or small window sizes, leading to resource tying up and potential attacks, where existing methods fail to promptly identify and counteract such malicious behavior.
Innovation Solution
A method involving an intermediary device that probes client connections for malicious window size attacks by sending window probes and disestablishing connections if the window size remains below a predetermined value, thereby preventing resource exhaustion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the sender waits for the receiver to increase the window size, then the connection remains open for flow control, but the sender's resources (memory, processing cycles, sockets, buffers) are tied up indefinitely
Solution Approach 1:
The intermediary device performs preliminary probing actions by sending window probe packets to the receiver before actual data transmission begins. This preliminary detection of malicious window size settings allows the system to prevent resource exhaustion before it occurs, resolving the contradiction by acting in advance rather than waiting passively for resources to be consumed
Solution Approach 2:
An intermediary device is introduced between the sender and receiver to detect and counteract malicious window size attacks. This intermediary probes the receiver's window size settings and can disestablish connections before they consume sender resources, thereby protecting resource utilization while maintaining legitimate connection stability
2Productivity
If the sender immediately disestablishs connections with small window sizes, then resource exhaustion is prevented, but legitimate connections with temporary slow receivers are incorrectly terminated
Solution Approach 1:
Instead of immediate termination, the intermediary device employs periodic probing over a predetermined time period to detect window size settings. This periodic action allows temporary slow receivers to establish legitimate connections while identifying persistent malicious behavior patterns, thus resolving the contradiction between preventing resource exhaustion and maintaining connection stability
Solution Approach 2:
The intermediary device uses feedback from window probe responses to determine whether to disestablish a connection. By analyzing the receiver's response to probes over time, the system can distinguish between legitimate temporary slow receivers and malicious actors, making resource protection more accurate while preserving legitimate connections
3Loss of time
If the intermediary probes aggressively within a short time period, then malicious connections are identified quickly, but the probing itself consumes network resources and time
Solution Approach 1:
The intermediary device sends a predetermined number of window probes (e.g., four probes) within a predetermined time period rather than continuous probing. This partial action approach provides sufficient detection capability to identify malicious connections quickly while limiting the total network resource consumption to an acceptable level, resolving the contradiction between fast detection and resource efficiency
Data Source
AI summary
The present application is directed towards systems and methods for aggressively probing a client side connection to determine and counteract a malicious window size attack or similar behavior from a malfunctioning client. The solution described herein detects when a connection may be under malicious attach via improper or unusual window size settings. Responsive to the detection, the solution described herein will setup probes that determine whether or not the client is malicious and does so within an aggressive time period to avoid the tying up of processing cycles, transport layer sockets and buffers, and other resources of the sender.