Protecting computing assets from segmented HTTP attacks
AssigneeArbor Networks, Inc.
InventorAaron Campbell
Life of this patent
Estimating the term…
Abstract
A method and system for managing data traffic and protecting computing assets. The method and system includes analyzing HTTP requests to determine if the HTTP requests are overly segmented, and, if the HTTP request is overly segmented, blocking and/or black-listing the malevolent communications and computing device. The analysis to determine if an HTTP request is overly segmented includes comparing the packet's size to a threshold, identifying the packet's content or lack thereof, identifying whether the packet is the last packet in a communication, and identifying whether the packet ends with the “\n” ASCII character.
Claims18
A computer-implemented method of detecting a Denial of Service (DoS) attack comprising:
- determining a size of a plurality of segmented HTTP packets that comprise a communication;
- and detecting an occurrence of a DoS attack on a server based on whether the following first conditions are satisfied:
- the determined size of a packet of the plurality of segmented HTTP packets is less than a threshold value;
- and the HTTP packet is not the last packet in the communication.
The computer-implemented method of claim the method further comprising:
- generating a reset packet;
- and
- issuing the reset packet to the server, wherein the reset packet is configured to instruct the server to release resources consumed by the DoS attack.
A computer-implemented method for detecting a Denial of Service (DoS) computer attack upon a server, comprising:
- determining whether an HTTP request is overly segmented, including;
- determining whether a packet size of more than one consecutive packet of the HTTP request is less than a threshold value;
- and determining that none of the more than one consecutive packets ends with a newline character;
- and detecting the occurrence of a DoS attack if the HTTP request is determined to be overly segmented.
A computer-implemented method of detecting a Denial of Service (DoS) attack in a communication from a computing device to a server, the communication comprising HTTP packets and the method comprising:
- determining which HTTP packets in the communication satisfy all three of the following conditions:
- (a) whether the HTTP packet is not the last packet in the communication;
- (b) whether the HTTP packet does not end with the “\n” ASCII character represented by 0A16;
- and
- (c) whether the HTTP packet consists essentially of HTTP header data.
Dependencies are inferred from the claim text.