SDN Controller Defending Web Servers Against HTTP DDoS Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DDoS defense mechanisms struggle to accurately detect and block application layer HTTP DDoS attacks, such as Slowloris and Slow HTTP POST attacks, which exploit incomplete HTTP requests to exhaust web server resources, as these attacks mimic normal traffic patterns, making them difficult to distinguish from legitimate traffic.
Innovation Solution
A system utilizing an SDN (Software-Defined Networking) architecture where the web server sends suspected HTTP Request messages to an SDN controller, which determines whether the traffic is an attack and directs network nodes to block or redirect the traffic, thereby preventing it from reaching the web server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network-based DDoS protection techniques analyze traffic patterns at network devices, then detection capability improves, but accuracy deteriorates because application layer attacks mimic normal traffic patterns
Solution Approach 1:
The patent introduces an SDN controller as an intermediary component that sits between the network devices and the web server. The SDN controller receives traffic flow information from network devices, performs deep packet inspection to analyze HTTP request patterns, and makes intelligent decisions about blocking malicious traffic. This intermediary approach enables accurate detection of application layer attacks by examining actual HTTP request content rather than relying solely on network-level traffic patterns.
Solution Approach 2:
The patent transitions from network-based detection (Layer 3-4) to application-based detection (Layer 7) by analyzing HTTP request messages at the application layer. This dimensional change allows the system to examine the actual content and structure of HTTP requests, including incomplete requests that characterize Slowloris attacks, thereby achieving accurate detection despite traffic patterns mimicking normal behavior at the network level.
2Measurement precision
If the web server directly handles and analyzes all incoming HTTP requests, then detection capability improves, but server resource consumption increases
Solution Approach 1:
The SDN controller serves as an intermediary that performs the computationally intensive task of analyzing HTTP request patterns and identifying malicious traffic. The web server's role is reduced to receiving legitimate requests and serving content, while the SDN controller handles the complex detection logic. This distribution of responsibilities allows accurate attack detection without overburdening the web server's resources.
Solution Approach 2:
The patent segments the DDoS protection function from the web server into a separate SDN controller component. The network device handles traffic forwarding, the SDN controller performs deep packet inspection and attack detection, and the web server handles legitimate request processing. This segmentation allows each component to specialize in its function, improving overall detection accuracy while preventing resource exhaustion of the web server.
3Ease of operation
If the web server maintains connections for incomplete HTTP requests, then protocol compliance improves, but vulnerability to resource exhaustion attacks increases
Solution Approach 1:
The SDN controller performs preliminary analysis of incoming HTTP requests before they reach the web server. It identifies incomplete HTTP requests that match attack patterns (such as Slowloris attacks) and blocks them at the network level. This preliminary action prevents malicious incomplete requests from consuming web server connection resources, while the web server maintains its protocol-compliant behavior for legitimate requests.
Solution Approach 2:
The system applies preliminary anti-action by proactively blocking suspicious HTTP requests that exhibit characteristics of resource exhaustion attacks. The SDN controller monitors connection patterns, identifies anomalous behavior such as continuously incomplete requests, and preemptively terminates these connections before they can exhaust server resources. This preliminary countermeasure protects the web server while allowing normal protocol operation.
Data Source
AI summary
Disclosed are a system of defending against a DDoS attack based on an SDN and a method thereof. According to the present invention, when the HTTP Request message suspected for the attack arrives at the web server, the web server sends the HTTP Request message to the SDN controller located in the network, and the SDN controller determines the DDoS attack instead of the web server which is the attack target and blocks the traffic from the attacker through the nodes on the network according to the determination result of the SDN controller. Thereby, the traffic suspected as the DDoS attack that exhausts available connection resources of the web server is input to the SDN controller instead of the web server. Thereby the web server can be protected from the DDoS attack and the maintenance of the normal operation of the web server can be secured.