Proxy Server Access Log Analysis for CDN DOS Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content delivery networks (CDNs) face challenges in detecting and mitigating denial of service (DOS) and distributed denial of service (DDOS) attacks, which disrupt the ability to provide content to legitimate users by flooding content servers with phony requests.
Innovation Solution
A method and system utilizing a proxy server in a CDN to analyze access logs for URL requests from specific IP addresses, identifying suspicious activity by comparing entry counts within a timeframe to threshold values, and taking remedial actions such as reporting or blocking IP addresses to prevent further attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the CDN monitors and analyzes all URL requests in access logs to detect DOS attacks, then the detection accuracy and response capability improve, but the system complexity and computational overhead increase
Solution Approach 1:
The patent segments the DOS detection function into a separate proxy server component that operates independently from the main CDN content delivery infrastructure. The proxy server specifically handles access log analysis and attack detection, while the CDN continues to handle content delivery. This segmentation allows the detection system to be optimized for security analysis without compromising CDN performance, and enables independent scaling of detection capabilities.
Solution Approach 2:
The proxy server acts as an intermediary between the CDN and potential attackers. It intercepts and analyzes URL requests before they reach the CDN content servers, examining access logs for patterns indicative of DOS attacks. This intermediary position allows the system to detect and respond to attacks without disrupting the normal content delivery operations of the CDN, effectively separating the security monitoring function from the content delivery function.
2Reliability
If the CDN implements real-time monitoring of URL requests from multiple IP addresses, then the ability to detect distributed DOS attacks improves, but the processing time and computational resources increase
Solution Approach 1:
The proxy server performs preliminary analysis of URL requests by maintaining and querying access logs that record incoming requests with their source IP addresses and timestamps. By pre-processing and storing this request information in structured logs, the system can quickly retrieve and analyze historical request patterns when detecting potential DOS or DDOS attacks, rather than having to process raw request data in real-time during an attack event.
Solution Approach 2:
The system implements feedback mechanisms where the proxy server continuously monitors access logs, compares request patterns against established thresholds, and automatically responds to detected attacks by blocking malicious IP addresses. This closed-loop feedback system allows the CDN to adapt to ongoing attacks dynamically, with the proxy server adjusting its blocking decisions based on continuous analysis of incoming request patterns and their relationship to detected attack thresholds.
Data Source
AI summary
Aspects of the present disclosure involve systems, methods, computer program products, and the like, for utilizing an access log of a proxy server device of a content delivery network (CDN) to detect and mitigate a denial of service (DOS) on a web or content server hosted by the CDN. Through an analysis of the content requests received at the proxy server listed in the access logs, one or more IP addresses may be identified as involved in a potential DOS attack or other suspicious behavior. Once identified, the suspicious activities of the one or more IP addresses may be tracked and aggregated over a particular period of time, with each detected suspicious request to the content server being counted. The count of suspicious requests to the content server may then be compared to one or more threshold values and a remediation action may occur when the thresholds are met or exceeded.