Patent ID: 9148440
Filing Date: 2015-09-29
Classification: H04L

Abstract:
1. A method in an analyzer module to detect and distinguish between a plurality of types of Denial-of-Service (DoS) attacks, wherein the analyzer module is within a same protected network and on-premise with a web application server executing on server hardware, wherein the web application server is to receive Hypertext Transfer Protocol (HTTP) request messages transmitted from devices that are off-premise and outside of the protected network and respond by transmitting HTTP response messages back to those devices, wherein the analyzer module is coupled to receive these HTTP request messages and HTTP response messages, the method comprising: tracking, in the analyzer module, whether test HTTP messages are timely received by the analyzer module, wherein the test HTTP messages comprise test HTTP request messages that a signal generation module is configured to transmit to the web application server according to a schedule and test HTTP response messages that the web application server is expected to transmit to the signal generation module in response to the test HTTP request messages, wherein the signal generation module is configured to transmit the test HTTP request messages for the purpose of allowing the analyzer module to detect and distinguish between the plurality of types of DoS attacks, wherein the signal generation module is executing on a device that is off-premise and outside the protected network, wherein the analyzer module is aware of a timeliness with which the signal generation module is expected to transmit the test HTTP request messages to the web application server and with which the web application server is expected to transmit the test HTTP response messages to the signal generation module in response to the test HTTP request messages; and detecting the occurrence of a DoS attack and identifying the type of the DoS attack based upon the result of the tracking indicating that a number of the test HTTP messages have not been timely received by the analyzer module.