TCP Connection Count Control for Denial-of-Service Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing countermeasures against connection-occupying denial-of-service attacks, such as those using Web Application Firewalls, are ineffective in detecting all types of attacks and often sacrifice normal traffic, failing to prevent sustained denial-of-service conditions when new attack connections occur at intervals shorter than the connection timeout period.
Innovation Solution
A connection control apparatus that calculates TCP connection counts between servers and clients, determines if the count exceeds a threshold, and detects anomalous connections conducting denial-of-service attacks using various analysis methods, including packet header analysis and throughput calculations, to prevent such attacks without affecting normal traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If connection duration timeout is used to detect anomalous traffic, then some types of attacks can be detected, but normal long-duration sessions are sacrificed and denial-of-service conditions are sustained when new attack connections come at intervals shorter than timeout period
Solution Approach 1:
The invention changes the detection parameter from connection duration timeout to TCP connection count threshold. Instead of monitoring how long connections last, the system monitors the number of concurrent TCP connections to the server. When the connection count exceeds a predetermined threshold, anomalous connections are detected and blocked. This parameter change allows the system to detect connection-occupying attacks without affecting normal long-duration sessions, as these sessions would not cause the connection count to exceed the threshold.
2Object-affected harmful factors
If packet-count-based countermeasure is used, then large-packet attacks can be prevented, but connection-occupying attacks using small packets are not prevented
Solution Approach 1:
The invention substitutes the packet-count-based mechanical counting mechanism with a TCP connection state monitoring mechanism. Instead of counting individual packets and applying thresholds, the system tracks the number of established TCP connections to the server using connection state information (such as SYN-SENT, SYN-RECEIVED, ESTABLISHED states). This substitution enables detection of connection-occupying attacks that use small packets, as the attack manifests as an abnormal number of concurrent connections rather than high packet volume.
Data Source
AI summary
A connection control apparatus is configured such that a connection count calculator calculates a TCP connection count, which is the number of TCP connections established between a server and one or more clients on a network, of each of servers on the network. The connection control apparatus is configured such that, when a determiner determines that the calculated count is larger than or equal to a predetermined threshold value, an anomalous connection detector detects anomalous connection, and a packet controller controls packet transmission and reception over the anomalous connection.