Server Connection Challenge for Low-and-Slow Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are inadequate in defending against low and slow attacks, which exploit application layer vulnerabilities and are difficult to distinguish from legitimate traffic, often requiring resource overprovisioning, stricter timeouts, or limiting functionality.
Innovation Solution
A method involving detecting low and slow attack characteristics and issuing a challenge to clients to immediately push their buffer contents, with connection termination if the challenge is not met within a threshold, using TCP PSH flag manipulation and tailored thresholds based on server and network activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If stricter timeout conditions are imposed to prevent low and slow attacks, then attack prevention is improved, but legitimate clients with slow connections are impacted
Solution Approach 1:
The system performs preliminary detection of attack characteristics (slow start patterns, excessive buffer requests, header completion delays) before the attack can fully consume resources. By issuing challenges proactively when suspicious patterns are detected, the system prevents resource occupation while allowing legitimate slow connections to complete naturally without premature timeout termination
2Reliability
If more resources are provided to reduce the impact of attacks, then attack resilience is improved, but system resource consumption increases
Solution Approach 1:
The system issues challenges proactively when suspicious patterns are detected, forcing attackers to consume resources immediately. This preliminary action prevents the gradual resource occupation that would otherwise require overprovisioning, as the challenge-response mechanism causes attacks to exhaust their buffer resources quickly rather than slowly over time
Solution Approach 2:
The system converts the attacker's slow transmission characteristic into a detection signal. By monitoring for slow start patterns and issuing challenges, the system turns the attacker's deliberate slowness into a recognizable attack signature that triggers protective action, rather than reacting only after resource consumption has occurred
3Reliability
If stricter size limits are imposed to prevent low and slow attacks, then attack prevention is improved, but server functionality is restricted
Solution Approach 1:
The system performs preliminary detection of malicious patterns (slow start, excessive buffer requests, incomplete headers) before enforcing size limits. This allows the server to maintain normal functionality for legitimate requests while identifying and challenging suspicious patterns, avoiding premature restriction of valid large transfers
Data Source
Figure 1~3
Figure 4
AI summary
The disclosure relates to a computer-implemented method of protecting a server, the method comprising: detecting (s220) one or more characteristics of a low and slow attack in a request to the server made over a connection between a client and the server; and responsive thereto, issuing (s240) a challenge to the client instructing the client to immediately push its entire buffer contents to the server. If the challenge is not complied with, the connection is terminated (s270) and otherwise the response is forwarded to the server (s290).