US 7,624,084 B2Granted

Method of generating anomaly pattern for HTTP flood protection

AssigneeRadware, Ltd.

InventorAvi Chesla

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and method to detect and mitigate denial of service and distributed denial of service HTTP “page” flood attacks. Detection of attack/anomaly is made according to multiple traffic parameters including rate-based and rate-invariant parameters in both traffic directions. Prevention is done according to HTTP traffic parameters that are analyzed once a traffic anomaly is detected. This protection includes a differential adaptive mechanism that tunes the sensitivity of the anomaly detection engine. The decision engine is based on a combination between fuzzy logic inference systems and statistical thresholds. A “trap buffer” characterizes the attack to allow an accurate mitigation according to the source IP(s) and the HTTP request URL's that are used as part of the attack. Mitigation is controlled through a feedback mechanism that tunes the level of rate limit factors that are needed in order to mitigate the attack effectively while letting legitimate traffic to pass.

Claims21

Dependent claims

A method for protecting a web server from hypertext transfer protocol (HTTP) flood attacks by detecting an anomaly in an HTTP request, wherein said method is implemented in a server accessible over a network, comprising:

receiving a plurality of real-time statistical parameters and a plurality of normal base line values, said plurality of real-time statistical parameters comprising at least one rate-based parameter, at least one rate-invariant parameter, wherein the rate-invariant parameter includes at least HTTP request URL size distribution parameters;
applying a plurality of embedded correlation rules on at least said received real-time statistical parameters;
generating, by a degree of anomaly generator, a degree of anomaly (DoA) based on said received plurality of real-time statistical parameters, said plurality of normal base line values, deviation analysis of said real-time statistical parameters from said normal base-line values, and said embedded correlation rules;
when said generated degree of anomaly indicates a HTTP flood attack, characterizing the anomaly using at least one trap buffer and based on normal base-line values of the URL size distribution parameters;
and
mitigating based on the characterized anomaly, by a mitigation mechanism, traffic flows of HTTP flood requests, thereby protecting said web server from said HTTP flood attacks.

3 more elements

A server-based a apparatus for providing HTTP flood protection comprising:

a statistics module computing a plurality of real-time statistical parameters, said plurality of real-time statistical parameters comprising at least one rate-based parameter, at least one rate-invariant and one rate-based parameter wherein the rate-invariant parameter includes at least HTTP request URL size distribution parameters;
a learning module for computing normal base line values;
an anomaly detection engine comprising a storage for storing embedded correlation rules and a degree of anomaly generator for generating a degree of anomaly (DoA) based on said received plurality of real-time statistical parameters said plurality of normal base line values, deviation analysis of said real-time statistical parameters from said normal base-line values, and said embedded correlation rules;
at least one source Internet protocol (IP) trap buffer for storing a first list of at least one source IP address that was identified based on an abnormal frequency of HTTP request URL that was generated by said at least one source IP address;
and
at least one HTTP request URL size trap buffer for storing a second list of at least one suspicious HTTP request size deviating from an adapted size distribution base line;
when said generated degree of anomaly indicates a HTTP flood attack, a decision engine communicates with said source IP trap buffer and said HTTP request URL size trap buffer to characterize the anomaly based on normal base-line values of the URL size distribution parameters;
and
a mitigation mechanism for mitigating traffic flows of HTTP flood requests based on the characterized anomaly.

6 more elements

Dependencies are inferred from the claim text.