KR101269552B1 - Method and apparatus for denial of service detection against incomplete get request of http - Google Patents

Abstract

In communication between a server and a client using HTTP, a method for detecting a denial of service (DoS) attack by an incomplete GET request message sent from a client to a server is provided. And counting the number of GET request packets of one GET request message transmitted by the client. If one GET request message sent by the client is larger than the MSS value (Maximum Segment Size) set in Transmission Control Protocol (TCP), the GET request message is divided according to the MSS value and transmitted to the server. And counting the number, and calculating the maximum number of packets (hereinafter, the maximum number of divided GET request packets) that the client can transmit by dividing one GET request message to the server using the MSS value. And determining whether the GET request message is normal by comparing the counted number of the divided GET request packets with the maximum number of divided GET request packets.

Description

TECHNICAL AND APPARATUS FOR DENIAL OF SERVICE DETECTION AGAINST INCOMPLETE GET REQUEST OF HTTP}

The present invention relates to a method and apparatus for detecting a denial of service attack by an incomplete GET request message in communication using HTTP. When a client requests an incomplete GET request message to a server, the server maintains an open connection, A method and apparatus for detecting a denial of service attack generated by using a characteristic of waiting for a GET request message.

The present invention is derived from research conducted as part of the IT growth engine technology development project of the Ministry of Knowledge Economy. [Task Management Number: 2009-S-038-01, Task Name: Development of Response Service for Distributed Service Denial (DDoS) Attack]

Recently, an attack tool called "Slowloris" has been disclosed that allows a web service to enter a Denial of Service (DoS) state as an attack using a structural vulnerability of the HTTP protocol.

The attack by this attack tool does not include data that the HTTP client sends a GET request message to the HTTP server, indicating the end of the message.

The HTTP server receives a GET request message but is incomplete, so it will continue to wait for the request until a complete GET request message is sent. However, the HTTP server does not wait for a message from the client, but disconnects if no message comes in for a set amount of time. Therefore, the attacker maintains a persistent connection by sending meaningless data instead of data that indicates the end of the message before disconnecting.

If the session is connected to the HTTP server by the preset limit, other clients can no longer connect to the HTTP server. Here, the session refers to a state in which a network connection is continuously maintained between two different hosts, that is, a client and a server.

Recent attacks, unlike traditional Distributed Denial of Service (DDoS) attacks, do not carry large amounts of traffic and can create a denial of service on an HTTP server with very little traffic. This typical attack is an attack that sends an incomplete HTTP GET request message to an HTTP server.

Currently, the attack pattern caused by an incomplete HTTP GET request message delivers a repetitive payload in order not to disconnect from the HTTP server, thus blocking the attack pattern as a signature. However, if the attack pattern is intelligent, there is a limit to blocking the attack pattern by signature.

 Accordingly, an object of the present invention is to provide a method for detecting a denial of service attack using an incomplete GET request message in order to defend against a denial of service attack (for example, Slowloris) that consumes resources of an HTTP server.

Another object of the present invention is to provide an apparatus using the method.

Method for detecting a denial of service attack using an incomplete GET request message according to an aspect of the present invention for achieving the above object of the present invention, the client sends a GET request message to receive a web service is transmitted at this time Counting the GET request message. If one GET request message is larger than MSS value (Maximum Segment Size) set in Transmission Control Protocol (TCP) and is divided into several packets and transmitted to the server, the GET request message is divided and transmitted to the server. Counting the number of GET request packets), and using the URL length restriction of the GET request message and the MSS value, a single GET request message is divided by MSS and transmitted to the server. Calculating a maximum number of packets (hereinafter, referred to as the maximum number of divided GET request packets) and comparing the number of divided GET request packets with the maximum number of divided GET request packets to determine whether the GET request message is a denial of service attack. It includes the process of judging.

An apparatus for detecting a denial of service attack using an incomplete GET request message according to another aspect of the present invention is an incomplete GET request message transmitted from the client to the server after a session connection is established between the client and the server is established A detection server for detecting a denial of service attack using a detection server, the detection server is connected between the client and the server to generate a session connection signal indicating that the session connection between the client and the server is completed, TCP (Transmission Control Protocol) A session manager configured to calculate the maximum number of the divided GET request packets that the client can transmit to the server using an MSS value (Maximum Segment Size) set in the step of receiving the divided GET request packets, and receiving the session connection signal In response to the MSS value (Maximum Segment) A counting unit counting the number of the divided GET request packets which are divided and transmitted to the server, and receives the divided GET request packet transmitted from the client to the server, and counts the divided GET request. And an attack determination unit that determines a denial of service attack by the GET request message according to a result of comparing the number of packets and the maximum number of divided GET requests.

According to another aspect of the present invention, a method of detecting a denial of service attack using an incomplete GET request message includes accumulating payload bytes or packets of a GET request message transmitted to the server after the session connection is completed. Process and the denial of service attack by the GET request message by checking whether the HTTP response message is received from the server when the payload byte number or the packet count of the accumulated GET request message reaches a preset threshold The attack determination unit to determine the.

According to the present invention, when transmitting a GET request message, when one GET request packet is divided by the MSS using the maximum length limit of the GET request message URL and the maximum segment size (MSS) that the HTTP client can transmit at once. By calculating the maximum number of split GET request packets, a denial of service attack using an incomplete GET method request packet can be accurately determined. That is, the present invention accurately distinguishes between a normal GET request message and an incomplete GET request message, thereby detecting a denial of service attack in which the HTTP client maintains a session with the HTTP server in an open connection state and consumes resources of the HTTP server with less traffic. Can be.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First, prior to describing the preferred embodiment of the present invention, a general system composed of an HTTP web server and an HTTP client system will be described for better understanding of the present invention.

1 is a signal flow diagram between a server and a client using a general HTTP.

Referring to FIG. 1, first, an HTTP client system 100 (hereinafter, referred to as an HTTP client) requests a session connection by transmitting a SYN packet 10 to request a service from an HTTP web server 300. At this time, the HTTP web server 300 responds with a SYN + ACK (12) packet if resources are allowed. The HTTP client 100 receiving the SYN + ACK packet 12 sends the ACK packet 14 to the HTTP web server 300, thereby creating a new session.

As such, establishing a session through a three-stage connection process is commonly referred to as a three-way handshake process and is applied to all TCP communications. Thereafter, the HTTP client 100 requests a desired page to the HTTP web server 300 through the GET packet 16, receives a response packet 18 to the GET packet 16 from the HTTP web server 300, The desired page is provided through the received response packet.

In the above, the process for the HTTP client 100 to receive a general web service from the HTTP web server 300 has been described.

When requesting a plain HTML document, image, video, etc. to an HTTP server, the GET method is used. Therefore, the HTTP client sends a GET request message 16 as shown in FIG. 1 to request a desired page, and this message structure is shown in FIG.

FIG. 2 is a diagram illustrating the structure of a GET request message shown in FIG. 1.

Referring to FIG. 2, the GET request message consists of a request line 22, a message header 24, a blank line 26, and a message body 28. The end of each configuration is always marked with a carriage return and line feed (CRLF) (0x0d, 0x0a).

When the browser of the HTTP client 100 sends a request, a request line 22 (Request-Line) is represented. The request line 22 includes three pieces of information: a request method, a web document path (URI), and an HTTP version. The request method is called the HTTP request method, and the main methods are 'GET', 'POST', 'HEAD', 'PUT', and 'CONNECT'. In FIG. 2, a request method designated as 'GET' is shown.

The message header 24 expresses header information corresponding to additional information on the HTTP message, such as execution date, 'Accept', 'Accept-Language', 'Host' 'Connection', program name, version, and cookie. do. CRLF (0x0d, 0x0a) is always expressed at the end of each header information, and CRLF (0x0d, 0x0a) indicates the end of one header information.

Where 'Accept' is header information that tells the HTTP server which Multi-Purpose Internet Mail Extensions (MIME) content-types the HTTP client's browser can accept, and 'Accept-Language' is a header that indicates the language the browser will use. Information, and 'Host' is header information indicating the host and port in the URL. 'Connection' is header information used in case of maintaining persistent connection between HTTP client and HTTP server. Persistent connections between HTTP clients and HTTP servers are maintained through request lines specifying HTTP 1.1 and 'Keep-Alive' values for persistent connections. This saves a lot of time because you don't have to reopen the picture or applet in a Web page.

The blank line 26 signifies the end of the message header 24 and is likewise represented by CRLF (0x0d, 0x0a).

The message body 28 is always passed to the HTTP server in an empty state unless the method is a POST.

FIG. 3 is a diagram illustrating an example of a GET request message structure shown in FIG. 2.

Referring to FIG. 3, 'GET / HTTP / 1.1 (CRLF)' corresponds to the request line 22 of FIG. 2, and 'Accept: * / * (CRLF) to Connection: Keep-Alive' indicates the message of FIG. 2. Corresponds to header 24, and '(CRLF)' 36 corresponds to blank line 26 in FIG. Since the GET request message shown in FIG. 3 is a GET method request, a part corresponding to the message body part shown in FIG. 2 is empty.

Note in FIG. 3 are the end of the message header 34 and the blank line 36. CRLF (0x0d, 0x0a) is represented at the end of all header information included in the message header 34. Therefore, CRLF (0x0d, 0x0a) 34A is also expressed at the end of the last header information among the header information included in the message header 34, and after CRLF (0x0d, 0x0a) 34A is shown in FIG. Similarly, the blank line 36A is represented continuously. In this case, since the GET request message has no message body, the HTTP server recognizes the blank line 36 as the end of the request. Therefore, the blank line 36 must be included when transmitting the GET request message.

Thus, in a complete GET method request, CRLF (0x0d, 0x0a) 34A is represented at the end of the message header 34, followed by CRLF (0x0d, 0x0a) 36A by the blank line 36. CRLF ((0x0d, 0x0a) (0x0d, 0x0a)) are represented in succession.

However, in the case of an incomplete GET method request, when transmitting a GET request message, the CRLF 34A indicating the end of the message header 34 and the CRLF 36A represented in the blank line 36 do not appear consecutively. Therefore, the HTTP web server does not recognize the end of the request, so the HTTP web server waits for a subsequent request from the HTTP client and eventually reaches a timeout, or the HTTP client may return a CRLF (0x0d, 0x0a) instead of continually sending nonsense headers to deplete the resources of HTTP web servers, these HTTP web servers are also vulnerable to buffer overflow attacks. As such, the GET request message without the blank line 36A is determined to be a Denial of Service (DoS) attack using the HTTP structure format.

Therefore, in the embodiment of the present invention, two methods for proactively detecting a denial of service attack due to an incomplete GET request message are presented.

Both methods proposed in this embodiment are related to URL length.

Although the maximum value of the URL length is not defined in the HTTP protocol standard, the URL length is substantially limited by the HTTP client or the HTTP server as follows.

The length of the URL by the HTTP client is limited as follows depending on the browser used. In the case of Internet Explorer, you can enter a URL up to 2048 characters long. If you enter more URLs, an error screen is displayed. For Firefox, you can enter a 65536-character URL. In Safari, you can enter URLs of more than 80000 characters, and in Opera, you can enter URLs of 190,000 characters or more.

Looking at the limitations of the length of URLs by the HTTP server, the Apache server displays a 413 error screen when a request corresponding to a URL input of approximately 4000 characters is received from an HTTP client, and the IIS server responds to a URL input of 16384 characters from an HTTP client. The request is set by default.

Since web programmers do not know which browser they are using or which HTTP server they are using, they will do web programming based on the minimum length of URLs available everywhere. I will do some web programming.

If Microsoft sets the number of characters entered in the address bar of Internet Explorer to 2,083 characters and uses the GET method, 2,048 characters minus the actual action address is applied. Since one character is represented by 1 byte, the size of the GET request message is not larger than 2,048 bytes.

In addition, the maximum size of data that can be transmitted in TCP is defined as the Maximum Segment Size (MSS), and this MSS value is determined by the Maximum Transmission Unit (MTU) value as follows.

MSS = MTU-(IP header size)-(TCP header size)

Therefore, in case of Ethernet, 1460 bytes are determined as MSS except for MTU 1500, IP header size 20 bytes, and TCP header size 20 bytes. This means that the HTTP client and the HTTP server send their SMS values to the other party in the process of transmitting the SYN 10 and SYN + ACK 12 of FIG. 1 in the 3-way handshake process as shown in FIG. This is indicated by the option field in the TCP header.

4 is a diagram illustrating a signal flow between an HTTP client and an HTTP server according to the determined MSS.

As shown in FIG. 4, when a session is established by signals 40, 42, and 44 between the HTTP client 300 and the HTTP server 400, the HTTP client 300 sends a GET request message 46. Request the desired page to the HTTP server 400 through. At this time, if the URL length of one GET request message is larger than the MSS size, it is divided into several packets and transmitted. Therefore, considering the principle that one GET request message cannot exceed 2,048 bytes, and the principle that a message larger than MSS size can not be transmitted after a session connection, one GET request message exceeding the MSS size is not transmitted at a time. It is not sent many times. That is, the maximum number of divided GET request packets is a rounded up value of 2,048 bytes / MSS. For example, when the MSS of the HTTP client 300 is 1460, one GET request message is divided and the maximum number of packets that can be transmitted is 1.4 (2,048 / 1460), and when the value is rounded up, the value is 2. Therefore, when the HTTP client sends one longest GET request message of 2,048 bytes to the HTTP server, after the session is established, the first packet payload is sent 1460 bytes, followed by the second GET request packet payload. 588 bytes becomes the last packet. In other words, as shown in FIG. 3, in up to two divided GET request packets, CRLF (0x0d, 0x0a) 34A indicating the end of the last header of the message header 34 and CRLF (blank line 36) are indicated. 0x0d, 0x0a) 36A.

Since a maximum length of a URL is 2,048 bytes, one GET request message limited according to the URL length is described as the maximum number of divided GET request packets as a rounded up value of 2,048 bytes / MSS. This is called the roundup of 2,048 byte / MSS because the URL length limit is the smallest size in Internet Explorer among the URL length limits of HTTP clients and HTTP servers. As the length limit changes, it can change fluidly.

Hereinafter, a denial of service attack detection method by an incomplete GET request message according to an embodiment of the present invention using the above-described characteristics will be described.

5 and 6 are flowcharts illustrating a process of detecting a denial of service attack using an incomplete GET request message according to an embodiment of the present invention.

5 and 6, a denial of service attack detection process by an incomplete GET request message according to an embodiment of the present invention is described assuming that the server receives a GET request message from an HTTP client. However, a denial of service attack detection server may be provided between the HTTP client and the HTTP server, and a detection process of the denial of service attack by an incomplete GET request message according to an embodiment of the present invention may be performed in the detection server.

First, the HTTP server receives a packet from an HTTP client (S510). Here, the packet includes a header and a payload. The header contains the data needed to route and interpret the packet, and the payload contains the actual data received.

Subsequently, the HTTP server checks the current session connect state according to whether the ACK packet is received, that is, the 3 way handshake process is completed (S512).

If the session connection is not completed, the HTTP server initializes the number of GET request packets to '0' until the session connection is completed (S514).

When the session connection is completed, the HTTP server checks the number of GET request packets received so far from the HTTP client after the session connection is completed. If the message is long and divided and transmitted, the number of split GET request packets is checked (S516). If the number of received packets is '0', that is, no GET request packet has been received yet, the MSS value applied in the current session is extracted (S518), and the GET request packet received from the HTTP client after the session connection is completed. The payload length L value is extracted (S520).

In step S516, if the number of confirmed GET request packets is not '0', that is, if a currently received GET request packet is not the first one GET request message is larger than the MSS, the packet is divided and transmitted. The process of extracting the payload length value of the currently received packet is performed without going through step S518 (S520).

Subsequently, after the session connection, one GET request message is divided so far to count the number of transmitted packets, that is, the number of divided GET request packets (S522), and HTTP according to the number of counted packets (CNT) and the URL length. The GET request message is divided from the client to the HTTP server and the preset maximum number of packets that can be transmitted (MAX_CNT), that is, the maximum number of divided GET request packets are compared (S524). Here, the preset maximum number MAX_CNT may vary according to the URL length limitation of the HTTP client and the HTTP server. For example, the explorer whose URL length is limited to 2048 bytes is the most among the URL length limitations of other HTTP clients or HTTP servers. In the short case, when the MSS is 1460, the preset maximum number may be set to 2 (a rounding value of 2048 / MSS).

As a result of comparing the divided GET request packet count (CNT) and the preset divided GET request maximum packet count (MAX_CNT), if 'CNT> MAX_CNT', the HTTP server may not complete the GET request packet received in the current session. The GET request message, that is, detected as a denial of service attack (S532). The detected result is monitored by the system administrator, and subsequent actions to block the access of the packet can be performed. If the counted divided GET request packet number (CNT) is compared with the preset divided GET request maximum packet number (MAX_CNT), and if 'CNT <MAX_CNT', the HTTP server is the last of the currently received packet. It is determined whether two consecutive CRLFs are included in S526.

If the packet includes two consecutive CRLFs, the HTTP server determines that the GET request message received in the current session is a normal packet (S528).

When not including two consecutive CRLFs, the HTTP server compares the MSS value extracted in step S518 with the payload length L value of the packet extracted in step S520 (S530).

As a result of the comparison, if L <MSS, it is determined as an incomplete GET request message, that is, a denial of service attack (S532). Cannot be 'L>MSS', If 'L = MSS ' , it is determined whether the counted divided GET request packets (CNT) and the preset divided GET request maximum packet count (MAX_CNT) are the same (S534), and 'CNT == MAX_CNT ', The GET request message received in the current session is determined to be a denial of service attack by an incomplete GET request message (S532). If' CNT ≠ MAX_CNT ', it waits until the next divided GET request packet is received (S536). ). That is, in the case of 'CNT ≠ MAX_CNT', since one GET request message is divided into a plurality of packets and not yet received, the HTTP server waits for the next packet. In the HTTP server, when one GET request message is divided and transmitted, the serial processes S526, S528, S530, S532, and S534 are continued until the last packet is received.

7 is a block diagram illustrating an overall system configuration for detecting a denial of service attack using an incomplete GET request message according to an embodiment of the present invention.

Referring to FIG. 7, the entire system includes an HTTP client 100, an HTTP server 300 performing network communication with the HTTP client 100 through a wired / wireless network 150, and between the network 150 and the HTTP server. Included in the detection server 200 for detecting a denial of service attack using an incomplete GET request message.

The HTTP client 100 and the HTTP server 300 basically establish a session by a 3 way handshake process. When the session is configured, the HTTP client 100 basically sends a GET request message to the HTTP server 300 according to the GET method. In this case, the detection server 200 uses the maximum URL length limit and the packet size limit MSS that the HTTP client can transmit at one time, and the HTTP client 100 transmits one GET request message while the GET may be divided and sent by the MSS. Calculate the maximum number of packets requested.

The detection server 200 detects a denial of service attack by distinguishing a complete GET request message from an incomplete GET request message based on the calculated maximum number.

Hereinafter, the detection server will be described in detail.

FIG. 8 is a block diagram illustrating an example of an internal configuration of the detection server illustrated in FIG. 7.

Referring to FIG. 8, the detection server 200 may distinguish between a session management unit 210, a counting unit 220, and a first comparison unit 230 to distinguish a GET request packet corresponding to a denial of service attack from a normal user's GET request packet. ), A packet analyzer 240, and a second comparator 250.

The session manager 210 extracts an MSS value from packets (40 and 42 of FIG. 4) that the HTTP server 100 and the HTTP client 300 exchange with each other for session connection. The session managing unit 210 uses the smallest URL length limit value among URL maximum length values currently limited by the browser and the web server and the extracted MSS value to determine the maximum number MAX_CNT ([URL length limit value / MSS value]). Rounded). In addition, when the session connection is completed between the HTTP server 300 and the HTTP client 100, the payload length (L) value of the GET request packet transmitted from the HTTP client 100 to the HTTP server 300 after the session connection is completed. Extract In this case, when the payload length L value of the GET request packet exceeds the MSS value and one GET request message is divided and transmitted, the payload length L values of the divided GET request packets are respectively transmitted. Extract. In addition, the session manager 210 generates a session connection signal S1 indicating that the session connection is completed. For example, the session manager 210 responds to an ACK packet (44 in FIG. 4) transmitted from the HTTP client 100 to the HTTP server 300. By doing so, the session connection signal S1 may be generated. The generated session connection signal S1 is transmitted to the counting unit 220.

The counting unit 220 counts the number of split GET request packets CNTs transmitted from the HTTP client 100 to the HTTP server 300 after the session connection in response to the session connection signal S1. That is, one received GET request message is divided and counted the number of transmitted packets CNT, and the counted result is transmitted to the first comparator 230.

The first comparison unit 230 compares the counted divided GET request packet number CNT from the counting unit 220 with the maximum number of divided GET request packets MAX_CNT from the session manager 210. In response to the comparison result, one of the first comparison signal C1-1 and the second comparison signal C1-2 is output. Here, the first comparison signal C1-1 is a signal indicating a case where the counted divided GET request packets CNT is larger than the divided maximum GET request packets MAX_CNT, and the second comparison signal C1. -2) is a signal indicating when the counted divided GET request packets (CNT) are less than or equal to the maximum number of divided GET request packets (MAX_CNT).

The attack determination unit 240 analyzes the GET request packet transmitted to the HTTP server 300 at the time when the signal C1-1 or C1-2 is received. When the attack determination unit 240 receives the first comparison signal C1-1, the attack determination unit 240 determines that the GET request packet in the current session is an attack packet due to an incomplete GET request message, that is, a denial of service attack, and the second comparison signal ( When receiving C1-2), it is determined whether two consecutive CRLFs (34A and 36A of FIG. 3) are included at the end of the packet transmitted to the HTTP server 300. If two consecutive CRLFs (34A and 36A in FIG. 3) are included at the end of the packet, the current GET request packet transmitted from the HTTP client to the HTTP server 300 is determined as a normal packet. Meanwhile, if two consecutive CRLFs do not exist at the end of the GET request packet, the attack determination unit 240 generates a driving signal D1 for driving the second comparator 250.

The second comparator 250 compares the payload length L value of the GET request packet and the MSS value in response to the driving signal D1, and compares the result of the comparison with the third comparison signal C2-1 or the fourth. It outputs as the comparison signal C2-2. The output third comparison signal C2-1 or fourth comparison signal C2-2 is transmitted to the attack determination unit 240. Here, the third comparison signal C2-1 is a signal output from the second comparison unit 250 when the payload length L value of the GET request packet is smaller than the MSS value, and the fourth comparison signal C2-2. ) Is a signal output from the second comparator 250 when the payload length L value of the packet is greater than or equal to the MSS value.

When the payload length L value of the packet is smaller than the MSS value, the attack determiner 240 receives the third comparison signal C2-1 transmitted from the second comparator 250 and transmits the current comparison session in the current session. The GET request message is determined to be an incomplete packet, that is, a denial of service attack. If the payload length L value of the packet is greater than or equal to the MSS value, the attack determiner 240 receives the fourth comparison signal C2-2 transmitted from the second comparator and divides the counted division. If the number of GET request packets (CNT) is equal to the number of split Get request max packets (MAX_CNT), the GET request packet transmitted in the current session is determined to be an incomplete packet, that is, a denial of service attack.

9 to 10 are signal flows between a server and a client for explaining a method of detecting an incomplete GET request message according to another embodiment of the present invention.

9 to 10, in the method for detecting a denial of service attack using an incomplete GET request message according to another embodiment of the present invention, the same principle as the detection method described with reference to FIGS. 5 and 6 is used. In the description of FIGS. 5 and 6, it is determined whether a denial of service attack using a GET request message is determined by determining whether two consecutive CRLFs exist at the end of one GET request message. In, the existence of two consecutive CRLFs is confirmed at the end of one GET request message without checking whether two consecutive CRLFs exist.

In another embodiment of the present invention, the presence of two consecutive CRLFs is confirmed through an HTTP response packet.

As shown in FIG. 9, the normal GET request message is divided into two packets 52 and 54 when the URL length of one GET request message transmitted by the client exceeds the MSS value and is transmitted to the server. When the request packet is sent to the server, the client receives an HTTP response message such as "HTTP / 1.1 200 OK" from the server. This HTTP response message includes all types of packets including the HTTP status code of the standard document.

On the other hand, the incomplete GET request message is shown in Figure 10, even if the URL length of one GET request message exceeds the MSS value is divided into several packets and transmitted from the client to the server, the client is the one The HTTP response message for the GET request message 62 is not received from the server.

Therefore, after the session connection is completed, the client accumulates the payload byte number or the packet number of the GET request message, and sends the HTTP response message from the server even though the payload byte number or the packet number of the GET request message is transmitted over the preset threshold. If not received, the transmitted GET request message is determined to be an incomplete GET request message, that is, a denial of service attack. For example, the preset threshold may be set to 5 accumulated packets or 2000 bytes.

The present invention has been described above with reference to preferred embodiments. It will be understood by those skilled in the art that the present invention may be embodied in various other forms without departing from the spirit or essential characteristics thereof. For example, although the detection server illustrated in FIG. 7 is described as being provided between the client and the server, the components provided in the detection server may be provided in the server. Therefore, the above-described embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is shown not in the above description but in the claims, and all differences within the scope should be construed as being included in the present invention.

1 is a signal flow diagram between a server and a client using a general HTTP.

FIG. 2 is a diagram illustrating the structure of a GET request message shown in FIG. 1.

FIG. 3 is a diagram illustrating an example of a configuration of a GET request message shown in FIG. 2.

4 is a signal flow diagram between a client and a server according to a preset MSS.

5 and 6 are flowcharts illustrating a process of detecting a denial of service attack by an incomplete GET request message according to an embodiment of the present invention.

7 is a block diagram illustrating an overall system configuration for detecting a denial of service attack using an incomplete GET request message according to an embodiment of the present invention.

FIG. 8 is a block diagram illustrating an example of an internal configuration of the detection server illustrated in FIG. 7.

9 and 10 are signal flows illustrating a server and a client for explaining a method of detecting a denial of service attack by an incomplete GET request message according to another embodiment of the present invention.

Claims (20)

In the communication between the server and the client using HTTP, a method for detecting a denial of service attack by an incomplete GET request message sent from the client to the server after the session connection is completed, Counting a GET request message sent by the client; Counting the number of GET request packets of one GET request message, if one GET request message is longer than the MSS value (Maximum Segment Size) set in Transmission Control Protocol (TCP), it is divided according to MSS and transmitted to the server Counting the number of packets; The client divides one GET request message longer than the MSS according to the MSS value (Maximum Segment Size) set in the Transmission Control Protocol (TCP), and calculates the maximum number of the divided GET request packets that can be transmitted to the server. step; And Determining whether a denial of service attack is caused by the GET request message by comparing the counted divided GET request packets with the calculated maximum number of GET request packets. Method for detecting a denial of service attack using an incomplete GET request message comprising a. The method of claim 1, wherein the determining of the denial of service attack by the GET request message comprises: And determining the GET request message as an attack when the number of counted GET request packets is greater than the calculated maximum number of GET request packets. The method of claim 1, wherein the calculating of the maximum number of calculated GET request packets comprises: A method of detecting a denial of service attack using an incomplete GET request message, in which the smallest URL length limit value that can be used by a GET request message among client and server URL length restrictions is divided by the MSS value and rounded up. 4. The server of claim 3, wherein the client is loaded with one of Explorer, Firefox, Safari, and Opera, and the server detects a denial of service attack using an incomplete GET request message which is a web server loaded with one of Apache and IIS. How to. 2. The method of claim 1, wherein when the number of counted GET request packets is less than or equal to the calculated maximum number of GET request packets, determining whether two counted CRLFs are included in the counted GET request packets. More, And if the counted GET request packet includes two consecutive CRLFs, the counted GET request packet is determined to be a normal packet. The method of claim 5, wherein determining whether the counted GET request packet includes two consecutive CRLFs comprises: If the number of counted GET request packets is plural, denial of service attack using an incomplete GET request message, which is a step of determining whether the GET request packet transmitted to the server includes the two consecutive CRLFs last; How to detect it. The method of claim 5, wherein the GET request packet does not include two consecutive CRLFs. Extracting a payload length value of a GET request packet transmitted to the server; And Comparing the payload length value of the extracted GET request packet with the MSS value to determine whether a denial of service attack using the GET request message is detected. How to. The method of claim 7, further comprising: determining whether a denial of service attack is performed using the GET request message. When the payload length value of the extracted GET request packet is smaller than the MSS value, a denial of service attack using an incomplete GET request message is determined to determine the GET request packet as a denial of service attack by an incomplete GET request message. How to. The method of claim 7, further comprising: determining whether a denial of service attack is performed using the GET request message. If the number of split GET request packets is equal to the calculated maximum number of GET request packets, the GET request message is determined to be a denial of service attack using an incomplete GET request message. How to detect an attack. 10. The method of claim 9, A method of detecting a denial of service attack using an incomplete GET request message when the number of counted GET request packets is equal to the calculated maximum number of GET request packets when the packet payload length value and the MSS value are the same. . An apparatus for detecting a denial of service attack using an incomplete GET request message transmitted from the client to the server after the session connection is established and the session connection is established, Generate a session connection signal connected between the client and the server to indicate that the session connection between the client and the server is completed, the client using the MSS value (Maximum Segment Size) set in the Transmission Control Protocol (TCP) A session manager configured to calculate the maximum number of packets that can be sent by the MSS to send one GET request message to the server; A counting unit which receives the packet and counts the number of packets which are divided according to the MSS value (Maximum Segment Size) and transmitted to the server in response to the session connection signal; And Denial of service by the GET request message according to a result of receiving the GET request packet transmitted from the client to the server and comparing the counted number of the divided GET request packets with the maximum number of the divided GET request packets. Attack judgment unit to determine the attack Apparatus for detecting a denial of service attack using an incomplete GET request message comprising a. The apparatus of claim 11, wherein the session manager generates the session connection signal in response to an ACK packet transmitted from the client to the server in a 3 way handshake process. . 12. The apparatus of claim 11, wherein the session manager extracts an MSS value (Maximum Segment Size) and the packet payload length value set in a transmission control protocol (TCP). . The method of claim 13, wherein the session manager calculates the maximum number of divided GET request packets using the length limit value of the URL of the GET request message limited by the server and the client in the browser and the extracted MSS value. And the maximum number is a result obtained by dividing the length limit value of the URL by the MSS value and denial of service attack using an incomplete GET request message. 14. The method of claim 13, A first comparing unit comparing the calculated maximum number of divided GET request packets with the counted divided GET request packets; And A second comparison unit comparing the MSS value and the packet payload length value Device for detecting a denial of service attack using an incomplete GET request message further comprising. 16. The method of claim 15, The first comparison unit may include a first comparison signal indicating a case in which the number of the divided GET request packets is greater than the maximum number of the divided GET request packets and the number of the divided GET request packets being smaller than the maximum number. The apparatus for detecting a denial of service attack using an incomplete GET request message, which transmits one of the second comparison signals indicating a small or small case to the attack determination unit. The method of claim 16, wherein the attack determiner determines that the packet transmitted from the client to the server is a denial of service attack using an incomplete GET request message in response to the first comparison signal, and in response to the second comparison signal. Apparatus for detecting a denial of service attack using an incomplete GET request message to generate a drive signal for driving the second comparator. The method of claim 17, wherein the second comparison unit compares the MSS value and the packet payload length value in response to the driving signal, The second comparison unit outputs any one of a third comparison signal indicating a case where a packet payload length value is smaller than an MSS value and a fourth comparison signal indicating a case where the packet payload length value is larger than or equal to an MSS value. A device that detects a denial of service attack using an incomplete GET request message. 19. The method of claim 18, wherein the attack determination unit determines that the packet transmitted from the client to the server in response to the third comparison signal as a denial of service attack by an incomplete GET message request, the rest in response to the fourth comparison signal A device for detecting a denial of service attack using an incomplete GET request message that is to receive a fragmented GET request packet. In the communication between the server and the client using HTTP, a method for detecting a denial of service attack using an incomplete GET request message transmitted from the client to the server after the session connection is completed, Accumulating, by the client, the payload byte number or the packet number of the GET request packet transmitted to the server; And When the client receives the HTTP response packet from the server when the payload byte number or the packet number of the accumulated GET request packet reaches a preset threshold, it is determined whether the GET request message is a denial of service attack. Steps to Method for detecting a denial of service attack using an incomplete GET request message that includes.

Images