Proxy Segmentation Analysis for HTTP Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Businesses are vulnerable to denial of service attacks, particularly those involving overly segmented HTTP communications that overwhelm servers, necessitating effective protection for computing assets.
Innovation Solution
A proxy system is placed between servers and devices sending HTTP requests to monitor and analyze packet size, content, and ASCII characters, identifying and blocking malicious communications by comparing packet sizes to thresholds and checking for specific ASCII markers, thereby blocking or blacklisting malevolent devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If HTTP communications are overly segmented to bypass detection, then the attack can evade simple packet filtering, but the server becomes overwhelmed and vulnerable to denial of service
Solution Approach 1:
The patent applies segmentation by dividing HTTP request analysis into multiple components: packet size analysis, ASCII character detection (particularly carriage return characters), HTTP method validation, and URI structure verification. This multi-layered segmentation approach allows the system to detect segmented attacks without overwhelming the server, as each component processes only specific aspects of the traffic
Solution Approach 2:
The patent introduces an intermediary detection system positioned between the attacking devices and the target server. This intermediary monitors and analyzes HTTP packets for segmentation patterns, malicious ASCII characters, and protocol violations, then blocks identified threats before they reach the server, thus protecting server availability while maintaining attack detection capability
2Measurement precision
If packet size thresholds are set low to detect segmented attacks, then malicious communications are identified more effectively, but legitimate small packets may be falsely blocked
Solution Approach 1:
The patent employs multiple parameters for attack detection rather than relying solely on packet size thresholds. These parameters include: presence of carriage return ASCII characters in inappropriate positions, HTTP method validity, URI structure correctness, and packet sequence analysis. By changing from a single parameter (packet size) to multiple parameters, the system achieves high attack identification accuracy while minimizing false positives through cross-validation of multiple criteria
3Measurement precision
If comprehensive packet analysis is performed to identify malicious communications, then attack detection accuracy improves, but processing time and system resources increase
Solution Approach 1:
The patent implements preliminary action by establishing baseline HTTP protocol expectations and common attack patterns before traffic analysis begins. The system pre-configures valid HTTP methods, expected URI structures, and characteristic malicious patterns (such as specific ASCII character sequences). During traffic analysis, packets are quickly evaluated against these pre-established criteria, enabling comprehensive detection without excessive processing time
Solution Approach 2:
The patent applies partial action by performing different levels of analysis on different packets based on initial screening. Packets that clearly match legitimate patterns receive minimal processing, while packets showing any signs of malicious behavior undergo more comprehensive analysis. This selective approach maintains high detection accuracy while reducing overall processing time by avoiding exhaustive analysis of every packet
Data Source
AI summary
A method and system for managing data traffic and protecting computing assets. The method and system includes analyzing HTTP requests to determine if the HTTP requests are overly segmented, and, if the HTTP request is overly segmented, blocking and/or black-listing the malevolent communications and computing device. The analysis to determine if an HTTP request is overly segmented includes comparing the packet's size to a threshold, identifying the packet's content or lack thereof, identifying whether the packet is the last packet in a communication, and identifying whether the packet ends with the “\n” ASCII character.