Slow HTTP Attack Mitigation via Connection Reset
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques fail to comprehensively mitigate slow HTTP attacks, which disrupt network communications by overwhelming web servers with slow requests, leading to legitimate clients being blocked or unable to access websites.
Innovation Solution
A protection device monitors HTTP requests for suspicious behavior, such as slow transfer rates and prolonged header times, and sends reset packets to suspected connections, while maintaining a blacklist of offending IP addresses to prevent further attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If the maximum number of simultaneous connections is increased, then the web server can handle more clients, but the attacker can also increase connections to overwhelm the server
Solution Approach 1:
The patent applies local quality by implementing different connection handling policies for different clients based on their behavior characteristics. Legitimate clients receive normal connection service while attackers are detected and blocked through monitoring their request patterns, transfer rates, and connection behaviors. This allows the system to maintain high connection capacity while protecting against abuse.
Solution Approach 2:
The patent implements feedback mechanisms by continuously monitoring connection behaviors and using this information to dynamically adjust connection management. The system monitors transfer rates, request patterns, and connection durations, then provides feedback to the connection manager which adjusts connection acceptance and resource allocation accordingly, preventing attacker connections from consuming excessive resources.
2Loss of time
If the maximum time for request transmission is decreased, then the web server can detect slow requests faster, but legitimate clients with slow connections may be incorrectly blocked
Solution Approach 1:
The patent applies local quality by implementing differentiated timeout and monitoring policies based on individual connection characteristics. Instead of a uniform timeout for all connections, the system monitors each connection's transfer rate, request pattern, and behavior over time, adjusting detection thresholds and response actions according to the specific client's behavior profile.
Solution Approach 2:
The patent implements dynamic connection management by continuously adapting monitoring parameters and timeout values based on real-time observation of connection behavior. The system adjusts detection sensitivity, timeout periods, and resource allocation dynamically rather than using fixed parameters, allowing it to respond appropriately to both slow legitimate clients and attackers.
3Reliability
If connection monitoring and reset actions are implemented, then slow HTTP attacks can be mitigated, but additional system resources and complexity are required
Solution Approach 1:
The patent applies self-service by implementing monitoring and detection capabilities that use the existing web server infrastructure and connection handling mechanisms. The system leverages the web server's built-in connection management, logging, and response capabilities to detect and mitigate attacks without requiring completely separate monitoring infrastructure, thereby reducing overall system complexity.
Solution Approach 2:
The patent implements multi-functionality by designing a connection management system that performs both normal connection handling and attack detection/mitigation using the same infrastructure. The monitoring mechanisms serve dual purposes: tracking legitimate client connections for service management and detecting attacker patterns for security, eliminating the need for separate dedicated monitoring systems.
Data Source
AI summary
A system and methods for mitigation slow HTTP, SSL/HTTPS, SMTP, and/or SIP attacks. A protection system monitors each TCP connection between a client and a server. The protection system monitors the header request time and minimum transfer rate for each client and TCP connection. If the client has not completed the data transfer in the minimum time or the data are not transferred at the minimum transfer rate, the protection system determines the connections are potentially a slow attack and resets the connections for the protected devices.