CN109246157B - Correlation detection method for HTTP slow request DOS attack - Google Patents

Abstract

The invention relates toAn association detection method for HTTP slow request DOS attack collects and analyzes the incoming flow data packet and the outgoing flow data packet of WEB server toTAnd screening to obtain an HTTP protocol data packet set for a time unit, analyzing the slow attack characteristic and the return code of the flow data packet set, respectively obtaining and associating the total number of data packets with the slow attack characteristic and the total number of data packets which cannot be accessed by the server, and detecting to obtain the state of providing the HTTP service externally by the server. The invention can quickly identify the data packet with the HTTP slow request characteristic, support cold start, give an alarm in time and stop loss in time before a safety event occurs; when the server resource is detected to be exhausted and the service cannot be normally provided, the quick response to the service error is carried out, the detection accuracy is improved, and the false alarm is reduced; the statistical time window is short, the detection is timely, the processing can be timely carried out under the condition of large data volume, and excessive performance loss or calculation delay can not be caused.

Description

Correlation detection method for HTTP slow request DOS attack

Technical Field

The invention relates to the technical field of digital computing equipment or data processing methods particularly suitable for specific functions, in particular to an association detection method for HTTP slow request DOS attacks.

Background

A DoS attack (Denial-of-service attack) is a network attack in which an attacker may attack a server for a short time or a long time, so that the server or a network source may not provide a service to a user normally. A typical attacker, in order to launch a large attack with limited resources, will typically set the query speed per second of a single broiler chicken to a large value, e.g. 5 to 10 times per second, which is typically directed to lower layers in the network stack, typically the transport layer, whereas an HTTP slow request attack exploits the drawbacks of the HTTP protocol, launching the attack through the seventh layer.

The HTTP Post method is to use the long connection defect of the HTTP protocol version 1.1, and an attacker declares a large value in the content length of a data packet, but sends the remaining data at a very slow rate, so that the connection is always occupied, and a general user cannot acquire the resource of the server.

Patent application No. CN201610556957.3 discloses a method and device for detecting DDoS attacks on a Web application layer based on generalized Jacard similarity coefficients, which are used for calculating the similarity between an attribute set and a historical normal attribute set in a time interval by using a Jacard similarity coefficient calculation formula, comparing the similarity with a preset threshold value, and detecting the Http slow request attacks. The defects of the patent technology are that the historical flow needs to be subjected to calculation learning, and the model training takes much time and is complicated in calculation.

Patent application No. CN201510925630.4 discloses a method for preventing HTTP slow attack, which includes the steps of firstly, depending on traffic learning, intelligently learning the traffic of a protected host which is normally accessed, identifying which pages are resource-consuming pages by using an access time difference value, recording the information of the pages, then, constructing a URL hash monitoring table by using page URLs of the resource-consuming pages, counting the number of times that each source IP accesses each resource-consuming page and the total number of times that the source IP accesses the website in each period, then summarizing when the period time is up, and calculating the number of time-consuming page accesses of each source IP; if the number of the resource consumption pages accessed by some source IPs exceeds the set threshold value in a plurality of continuous periods, the source IPs are indicated to be engaged in low flow all the time to obtain large calculation amount server resources, and then the access is limited. The technology of the patent has the defects that the hash table is larger and larger along with the time, the judgment threshold is difficult to determine, and false alarm is easy to generate.

Disclosure of Invention

The invention solves the problems that computation learning of historical flow is required, model training takes more time and computation is complex, a hash table is larger and larger along with the time, a judgment threshold value is difficult to determine, and false alarm is easy to generate in the prior art in the detection of the HTTP slow request DOS attack.

The technical scheme adopted by the invention is that the correlation detection method of the HTTP slow request DOS attack comprises the following steps:

step 1: respectively collecting an incoming flow data packet and an outgoing flow data packet of a WEB server;

step 2: analyzing the incoming flow data packet and the outgoing flow data packet, and screening to obtain an HTTP protocol data packet set D by taking T as a time unit_i＝{X₁,X₂,X₃,……X_mM is the number of data packets;

and step 3: for flow data packet set D_iThe slow attack characteristics are analyzed to obtain the total number S of the data packets with the slow attack characteristics_post；

And 4, step 4: for flow data packet set D_iThe return code is analyzed to obtain the total number S of the data packets which cannot be accessed by the server_error；

And 5: to S_postAnd S_errorAnd performing association, and detecting the state of the server for providing the HTTP service externally.

Preferably, in the step 2, T is 10 minutes.

Preferably, in step 3, the slow attack feature is a SlowHTTP POST feature.

Preferably, the step 3 comprises the steps of:

step 3.1: let t be 1;

step 3.2: if packet X_tIf the request header of (1) meets the condition that the content length is greater than 5000 and the connection state is active, then for X_tThe value is assigned to 1, otherwise, the value is assigned to 0; t is t +1, if t is more than m, the next step is carried out, otherwise, the step 3.2 is repeated;

step 3.3: all assignments with the same source IP obtained in step 3.2 are taken as set R_srcIP＝{r₁,r₂,r₃,……r_n}，R_srcIPThe value in (3) is consistent with the value assigned to the data packet;

step 3.4: the total number of the data packets with the HTTP slow request attack characteristic is obtained

Preferably, the step 4 comprises the steps of:

step 4.1: let t be 1;

step 4.2: if packet X_tIf the return code is more than or equal to 200 and less than 500, the value is assigned to be 0, otherwise, the value is assigned to be 1; t is t +1, if t is more than m, the next step is carried out, otherwise, the step 4.2 is repeated;

step 4.3: all assignments with the same source IP obtained in step 4.2 are taken as set C_srcIP＝{c₁,c₂,c₃,……c_n}，C_srcIPThe value in (3) is consistent with the value assigned to the data packet;

step 4.4: obtaining the total number of the data packets which cannot be accessed by the server as

Preferably, the step 5 comprises the steps of:

step 5.1: when S is_postWhen the security Event is more than 150, a security Event1 is generated_srcIP；

Step 5.2: when S is_errorWhen the security value is more than 100, a security Event2 is generated_srcIP；

Step 5.3: for each of the requesting parties, the requesting party,

if an Event1 is generated at the same time_srcIPAnd Event2_srcIPIf the server is not capable of providing the service normally, the server is judged to be attacked by HTTP slow request DOS;

if only Event1 is generated_srcIPIf yes, judging that the requesting party tries to carry out HTTP slow request DOS attack but does not cause damage;

if only Event2 is generated_srcIPJudging that the server cannot normally provide the service;

if no Event1 is generated_srcIPAnd Event2_srcIPThe server is normal.

The invention provides an optimized correlation detection method for HTTP slow request DOS attack, which is characterized in that an HTTP protocol data packet set D is obtained by acquiring and analyzing an incoming flow data packet and an outgoing flow data packet of a WEB server and screening by taking T as a time unit_iFor a set of traffic packets D_iIs divided into a slow attack feature and a return codeAnalyzing, respectively obtaining and correlating the total number S of the data packets with the slow attack characteristics_postAnd total number of data packets S inaccessible to the server_errorAnd detecting the state of the server for providing the HTTP service externally.

The invention has the following beneficial effects:

(1) the method can quickly identify the data packet with the HTTP slow request characteristic, supports cold start, can give an alarm in time in the initial stage of attack initiation, and can stop loss in time before a security event occurs;

(2) by adopting a causal association method, when the server resource is detected to be exhausted and the service cannot be normally provided, whether the service is caused by HTTP slow request DOS attack or not is distinguished, the service error can be quickly responded, the detection accuracy is improved, and the false alarm is reduced;

(3) the method has the advantages of realizing quasi-real-time detection, having short statistical time window, realizing timely detection, realizing timely processing under the condition of large data volume, and avoiding excessive performance loss or calculation delay.

Detailed Description

The present invention is described in further detail with reference to the following examples, but the scope of the present invention is not limited thereto.

The invention relates to a correlation detection method of HTTP slow request DOS attack, which comprises the steps of firstly, collecting data packets, then analyzing, screening a data packet set meeting conditions, calculating and correlating, and detecting the behavior that the server cannot access the DoS attack in the HTTP slow request mode.

The method comprises the following steps.

Step 1: and respectively collecting an incoming flow data packet and an outgoing flow data packet of the WEB server.

Step 2: analyzing the incoming flow data packet and the outgoing flow data packet, and screening to obtain an HTTP protocol data packet set D by taking T as a time unit_i＝{X₁,X₂,X₃,……X_mAnd m is the number of the data packets.

In the step 2, T is 10 minutes.

In the invention, the actual value of T can be analyzed and configured autonomously according to the actual situation by the technical personnel in the field.

And step 3: for flow data packet set D_iThe slow attack characteristics are analyzed to obtain the total number S of the data packets with the slow attack characteristics_post。

In the step 3, the slow attack feature is a slowHTTP POST feature.

The step 3 comprises the following steps:

step 3.1: let t be 1;

step 3.2: if packet X_tIf the request header of (1) meets the condition that the content length is greater than 5000 and the connection state is active, then for X_tThe value is assigned to 1, otherwise, the value is assigned to 0; t is t +1, if t is more than m, the next step is carried out, otherwise, the step 3.2 is repeated;

step 3.3: all assignments with the same source IP obtained in step 3.2 are taken as set R_srcIP＝{r₁,r₂,r₃,……r_n}，R_srcIPThe value in (3) is consistent with the value assigned to the data packet;

step 3.4: the total number of the data packets with the HTTP slow request attack characteristic is obtained

In the invention, the SlowHTTP POST characteristic is a slow attack characteristic, and under the characteristic, a request head generally meets the requirements of' ContentLength: [0-9] [0-9] [0-9] [0-9 ]? Keep-Alive, meaning that the attacker declares a large value in the content length of the packet, but keeps sending and sends the remaining data at a very slow rate, for packets with this characteristic, 1 is assigned, i.e. as a count.

In the invention, the set of the step 3.3 is the result calculated according to the method of the step 3.2 based on the source IP, and the data packets with consistent source IP calculate the result according to the step 3.2 in the time T and are put into a set R_srcIPTherefore, this set is the set of the same source IP computation results.

In the present invention, the determination in step 3.4And is to combine the set R_srcIPAll the data packets with the value of 1 are added together to obtain the sum S_post。

And 4, step 4: for flow data packet set D_iThe return code is analyzed to obtain the total number S of the data packets which cannot be accessed by the server_error。

The step 4 comprises the following steps:

step 4.1: let t be 1;

step 4.2: if packet X_tIf the return code is more than or equal to 200 and less than 500, the value is assigned to be 0, otherwise, the value is assigned to be 1; t is t +1, if t is more than m, the next step is carried out, otherwise, the step 4.2 is repeated;

step 4.3: all assignments with the same source IP obtained in step 4.2 are taken as set C_srcIP＝{c₁,c₂,c₃,……c_n}，C_srcIPThe value in (3) is consistent with the value assigned to the data packet;

step 4.4: obtaining the total number of the data packets which cannot be accessed by the server as

In the invention, in step 4, when the server has the phenomenon of being unable to access, a large number of return codes which are not beginning with 2, 3 and 4 appear in normal access, so when the return codes are more than or equal to 200 and less than 500, the value is assigned to be 0 to indicate normal, otherwise, 1 indicates error and is used for counting.

In the invention, the set of the step 4.3 is the result calculated according to the method of the step 4.2 based on the source IP, and in the time T, the data packets with consistent source IP calculate the result according to the step 4.2 and are put into a set C_srcIPTherefore, this set is the set of the same source IP computation results.

In the present invention, the summation of step 4.4 is to combine the set C_srcIPAll the data packets with the value of 1 are added together to obtain the sum S_error。

And 5: to S_postAnd S_errorAnd performing association, and detecting the state of the server for providing the HTTP service externally.

The step 5 comprises the following steps:

step 5.1: when S is_postWhen the security Event is more than 150, a security Event1 is generated_srcIP；

Step 5.2: when S is_errorWhen the security value is more than 100, a security Event2 is generated_srcIP；

Step 5.3: for each of the requesting parties, the requesting party,

if an Event1 is generated at the same time_srcIPAnd Event2_srcIPIf the server is not capable of providing the service normally, the server is judged to be attacked by HTTP slow request DOS;

if only Event1 is generated_srcIPIf yes, judging that the requesting party tries to carry out HTTP slow request DOS attack but does not cause damage;

if only Event2 is generated_srcIPJudging that the server cannot normally provide the service;

if no Event1 is generated_srcIPAnd Event2_srcIPThe server is normal.

The invention obtains the HTTP protocol data packet set D by collecting and analyzing the incoming flow data packet and the outgoing flow data packet of the WEB server and screening the data packets with T as the time unit_iFor a set of traffic packets D_iThe slow attack characteristic and the return code are analyzed to respectively obtain and correlate the total number S of the data packets with the slow attack characteristic_postAnd total number of data packets S inaccessible to the server_errorAnd detecting the state of the server for providing the HTTP service externally. The method can quickly identify the data packet with the HTTP slow request characteristic, supports cold start, can give an alarm in time in the initial stage of attack initiation, and stops loss in time before a security event occurs; by adopting a causal association method, when the server resource is detected to be exhausted and the service cannot be normally provided, whether the service is caused by HTTP slow request DOS attack or not is distinguished, the service error can be quickly responded, the detection accuracy is improved, and the false alarm is reduced; the method has the advantages of realizing quasi-real-time detection, having short statistical time window, realizing timely detection, realizing timely processing under the condition of large data volume, and avoiding excessive performance loss or calculation delay.

Claims (5)

1. An association detection method for HTTP slow request DOS attack is characterized in that: the method comprises the following steps:

step 1: respectively collecting an incoming flow data packet and an outgoing flow data packet of a WEB server;

step 2: analyzing the incoming flow data packet and the outgoing flow data packet, and screening to obtain an HTTP protocol data packet set D by taking T as a time unit_i＝{X₁，X₂，X₃，......X_mM is the number of data packets;

and step 3: for flow data packet set D_iThe slow attack characteristics are analyzed to obtain the total number S of the data packets with the slow attack characteristics_post；

And 4, step 4: for flow data packet set D_iThe return code is analyzed to obtain the total number S of the data packets which cannot be accessed by the server_error；

And 5: to S_postAnd S_errorPerforming association, and detecting to obtain the state of the server for providing the HTTP service;

the step 5 comprises the following steps:

step 5.1: when S is_postWhen the security Event is more than 150, a security Event1 is generated_srcIP；

Step 5.2: when S is_errorWhen the security value is more than 100, a security Event2 is generated_srcIP(ii) a Step 5.3: for each of the requesting parties, the requesting party,

if an Event1 is generated at the same time_srcIPAnd Event2_srcIPIf the server is not capable of providing the service normally, the server is judged to be attacked by HTTP slow request DOS;

if only Event1 is generated_srcIPIf yes, judging that the requesting party tries to carry out HTTP slow request DOS attack but does not cause damage;

if only Event2 is generated_srcIPJudging that the server cannot normally provide the service;

if no Event1 is generated_srcIPAnd Event2_srcIPThe server is normal.

2. The correlation detection method for the HTTP slow request DOS attack according to claim 1, characterized in that: in the step 2, T is 10 minutes.

3. The correlation detection method for the HTTP slow request DOS attack according to claim 1, characterized in that: in the step 3, the slow attack feature is a slowHTTP POST feature.

4. The correlation detection method for the HTTP slow request DOS attack according to claim 3, characterized in that: the step 3 comprises the following steps:

step 3.1: let t be 1;

step 3.2: if packet X_tIf the request header of (1) meets the condition that the content length is greater than 5000 and the connection state is active, then for X_tThe value is assigned to 1, otherwise, the value is assigned to 0; t is t +1, if t is more than m, the next step is carried out, otherwise, the step 3.2 is repeated;

step 3.3: all assignments with the same source IP obtained in step 3.2 are taken as set R_srcIP＝{r₁，r₂，r₃，......r_m}，R_srcIPThe value in (3) is consistent with the value assigned to the data packet;

step 3.4: the total number of the data packets with the HTTP slow request attack characteristic is obtained

5. The correlation detection method for the HTTP slow request DOS attack according to claim 1, characterized in that: the step 4 comprises the following steps:

step 4.1: let t be 1;

step 4.2: if packet X_tIf the return code is more than or equal to 200 and less than 500, the value is assigned to be 0, otherwise, the value is assigned to be 1; t is t +1, if t is more than m, the next step is carried out, otherwise, the step 4.2 is repeated;

step 4.3:all assignments with the same source IP obtained in step 4.2 are taken as set C_srcIP＝{c₁，c₂，c₃，......c_m}，C_srcIPThe value in (3) is consistent with the value assigned to the data packet;

step 4.4: obtaining the total number of the data packets which cannot be accessed by the server as