Server Timing Statistics for Slowloris Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting slowloris-type network attacks are cumbersome and resource-intensive, often requiring intercept devices and deep packet inspection, which can be impractical and ineffective in early stages of network attacks.
Innovation Solution
A computer-implemented method that tracks the timing of requests from clients to a server, calculates the mean and standard deviation of request timing distributions, and identifies changes indicative of a slowloris-type attack, allowing for alert generation and mitigation without the need for intercept devices or deep packet inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If intercept devices and deep packet inspection are deployed to detect network attacks, then detection capability is improved, but device complexity and resource consumption increase
Solution Approach 1:
The patent extracts only the essential timing information from network requests (time between request start and header completion) rather than performing full deep packet inspection. This extraction approach maintains attack detection capability while eliminating the need for complex intercept devices and comprehensive packet analysis systems.
Solution Approach 2:
The server itself generates and provides the timing data needed for attack detection through its existing request processing mechanisms. The server's natural operation of tracking request timing for connection management purposes becomes the source of detection data, eliminating the need for external monitoring devices to intercept and analyze packets.
2Measurement precision
If intercept devices are deployed for network monitoring, then attack detection capability is improved, but ease of operation deteriorates due to cumbersome deployment and configuration
Solution Approach 1:
The server automatically generates timing data as part of its normal request processing operations. No external monitoring devices need to be deployed, configured, or maintained. The system leverages the server's own operational data, making the solution as easy to implement as deploying or configuring the server itself.
3Measurement precision
If deep packet inspection is performed to detect slowloris attacks, then detection accuracy is improved, but resource consumption increases
Solution Approach 1:
The patent extracts only the critical timing metric (duration between request start and header completion) from the network traffic stream, rather than performing resource-intensive deep packet inspection of entire packets. This selective extraction maintains the ability to detect slowloris attacks while dramatically reducing computing resource consumption.
Solution Approach 2:
The patent replaces the mechanical process of deep packet inspection with a statistical analysis approach using timing distributions. Instead of examining packet contents through complex inspection algorithms, the system uses statistical properties of request timing intervals to identify attacks, reducing computational overhead.
4Loss of information
If conventional monitoring methods are used, then comprehensive traffic analysis is achieved, but ease of operation worsens due to inaccessibility to networks in many situations
Solution Approach 1:
The server itself provides the monitoring data through its own operational statistics. Since the solution uses data generated by the server's normal operation rather than requiring external network access, it can be deployed in situations where networks are inaccessible to external monitoring devices, such as air-gapped systems or restricted environments.
Data Source
AI summary
A system and computer-implemented method to detect a slowloris-type network attack, wherein the method includes receiving data gathered by a server of a network over time, the data received including data about timing of requests from a plurality of clients received by the server, tracking the data about timing of requests over time, determining one or more characteristics about distribution of the data tracked, tracking the one or more characteristics to determine whether there is an increase in time for reading, by the server, a larger portion of requests tracked, identifying a change in the characteristics that indicates the presence of a slowloris-type network attack, and performing an action, in response to the change, to at least one of generate an alert about the slowloris-type network attack, request mitigation of the slowloris-type network attack, and mitigate the slowloris-type network attack.