Server resource management, analysis, and intrusion negation

A console host and intrusion negation system (CHAINS) includes a host component [202] and a console component [203]. The host component [202] monitors resources at a server [501-503]. Resources that are becoming overloaded can be throttled back. Reports relating to resource usage may be transmitted to the console component. At the console component, resource reports from multiple host components may be viewed and managed.

RELATED APPLICATIONS

This application is related to the concurrently-filed application Ser. No. 10/290,834, titled “Systems and Methods For Preventing Intrusion at a Web Host.”

BACKGROUND OF THE INVENTION

A. Field of the Invention

The present invention relates generally to computer networks, and more particularly, to resource management of server computers in a public network, such as the Internet.

B. Description of Related Art

Network computer servers, such as computers that transmit HTML (HyperText Markup Language) documents to client computing devices on the Internet, may interact and receive data requests from many different end-users. It is frequently important that these computer servers maintain high levels of uptime. For example, if a server for an e-commerce site fails to respond to user requests, the site may lose sales.

There are many reasons why a server, or a group of servers, may fail. For example, the server may experience software or hardware errors that cause the server to fail. Additionally, the server may experience resource-related problems, such as too many users trying to simultaneously communicate with the server. Such resource-related problems can be “natural” resource problems in which too many bona fide users are trying to access the system simultaneously or malicious problems such as denial of service (DoS) or distributed denial of service (DDoS) attacks. In a DoS or DDoS attack, a compromised system or a multitude of compromised systems flood a server with incoming messages in an attempt to overwhelm the available server resources. Legitimate users of the server may then be denied service by the server due to the overload of its resources.

Accordingly, server system availability is an important concern for network servers, such as Internet servers. Conventional hardware solutions, such as clustering and failover, offer some assurances in this area by offering more resources to the users. However, these solutions can fail when faced with automated DoS and DDoS attacks that simply keep taking resources.

Accordingly, there is a need in the art to improve resource management in the face of attacks on system resources.

SUMMARY OF THE INVENTION

Systems and methods consistent with the principles of this invention implement a console host intrusion negation system (CHAINS) that monitors selected resources on one or more computer servers and throttles back resource usage when a server resource is overburdened.

A method consistent with an aspect of the invention includes monitoring resources associated with a network server and comparing activity levels of the resources to predetermined threshold activity levels. The method further includes reducing usage of one of the resources when the activity level associated with the resource increases above the predetermined threshold activity level.

A second aspect consistent with the invention is directed to a computer server that includes a processor, a communication interface, and a memory containing instructions. The instructions, when executed by the processor, cause the processor to monitor a usage level of the processor, the communication interface, and the memory. The instructions additionally compare the usage level of the communication interface to a first threshold and throttle back a number of active network connections when the usage level of the communication interface is greater than the first threshold; compare the usage level of the memory to a second threshold and shut down inactive processes when the usage level of the memory is above the second threshold; and compare the usage level of the processor to a third threshold and shut down inactive processes when the usage level of the processor is above the third threshold.

Yet another aspect of the present invention is directed to a system that includes a number of first computing devices and a second computing device. The first computing devices include a host software component configured to monitor resources of the first computing device and throttle back resource usage when resources of the first computing devices are being used above predetermined threshold levels. The second computing device includes a console software component configured to display alerts when the resources of the first computing devices are being used above the predetermined threshold levels.

Yet another aspect consistent with the present invention is directed to a method that includes displaying information relating to resources of remote computers, receiving information defining threshold levels for the resources at the remote computers, and transmitting the information defining the threshold levels for the resources to the remote computers. The remote computers throttle back resource usage when a resource usage level exceeds the threshold levels.

DETAILED DESCRIPTION

The following detailed description of the invention refers to the accompanying drawings. The same reference numbers may be used in different drawings to identify the same or similar elements. Also, the following detailed description does not limit the invention. Instead, the scope of the invention is defined by the appended claims and equivalents of the claim features.

As described below, a console host and intrusion negation system (CHAINS) monitors selected resources on one or more computer servers. Chains may include one or more host software components and a console software component. The host component resides on a server computer and monitors resource usage at the server. If a particular resource is used at a level above a preset threshold, the host component may take remedial action. The remedial action may include, for example, throttling back the resource or notifying a user via the console component.

System Overview

FIG. 1is a diagram illustrating an exemplary system100in which concepts consistent with the present invention may be implemented. System100may include a number of end-user computing devices101A and101B, a network102, and server computers103A-103D (collectively referred to as servers103). End-user computing devices101may include personal computers or the like through which users connect to network102. Network102may include any type of network, such as a local area network (LAN), a wide area network (WAN), a virtual private network (VPN), an intranet, the Internet, or a combination of networks. End-user computing devices101and servers103may connect to network102via wired, wireless, and/or optical connections.

Servers103may respond to requests for information from end-user computing devices101. For example, servers103may be HTML servers that interact with end-user computing devices101through hyper-text transfer protocol (HTTP) sessions to transmit HTML web pages to users. Server103may include a cluster of servers, such as the three servers103A-103C contained in cluster105. The servers103A=103C in cluster105may include a load-balancing mechanism through which the servers may jointly handle requests from end-user computing devices101in such a manner as to balance the distribution of work among the servers in cluster105.

FIG. 2is a diagram of an exemplary computing device that may correspond to one of servers103. Server103may include bus210, processor220, main memory230, read only memory (ROM)240, storage device250, input device260, output device270, and communication interface280. Bus210permits communication among the components of server103.

Processor220may include any type of conventional processor or microprocessor that interprets and executes instructions. Main memory230may include a random access memory (RAM) or another type of dynamic storage device that stores information and instructions for execution by processor220. ROM240may include a conventional ROM device or another type of static storage device that stores static information and instructions for use by processor220. Storage device250may include a magnetic and/or optical recording medium and its corresponding drive.

Input device260may include one or more conventional mechanisms that permit an operator to input information to computing device103, such as a keyboard, a mouse, a pen, a number pad, a microphone and/or biometric mechanisms, etc. Output device270may include one or more conventional mechanisms that output information to the operator, including a display, a printer, speakers, etc. Communication interface280may include any transceiver-like mechanism that enables computing device103to communicate with other devices and/or systems. For example, communication interface280may include mechanisms for communicating with another device or system via a network, such as network102.

In one implementation, main memory230may include computer programming instructions that implement a CHAINS host software component202and/or console software component203. The operation of host component202and console component203will be described in more detail below.

Chains

FIG. 3is a diagram conceptually illustrating the interaction of CHAINS host component202with resources associated with server103. In particular, host component202may interact with communication interface280, storage device250, memory230, and processor220. In general, these elements of server103can be considered to be resources of server103. Host component202monitors and controls the activity level of these resources.

FIG. 4is a flow chart illustrating operation of host component202consistent with an aspect of the invention. Host component202may begin by checking an activity level of communication interface280. This may include checking the number of open connections between server103and end-user computing devices101. An end-user computing device101that wishes to receive information from server103begins by transmitting a request for a connection with server103. Server103, in turn, can accept or reject the connection. Additionally, server103may keep track of the number of open connections at any particular time.

Host component202maintains a threshold level relating to the activity level of communication interface280. The threshold level may be set by a user either locally at server103or, as will be described in more detail below, from a remote computer running console component203. The threshold level may be derived manually by the user, or automatically, based on historical activity levels. Host component202may check to determine whether the activity level of communication interface280is above the threshold (Act402). If it is, host component202may take remedial actions to effectively throttle back the number of active connections (Act403). Such actions can include closing open connections. For example, host component202may first close connections that are open but inactive. If the number of connections is still too high, host component202may close connections that the server103classifies as lower priority connections. If the number of connections is still too high, host component202may begin to randomly close open connections. In addition, while the number of open connections is above the threshold, host component202may refuse any new connection requests from end-user computing devices101.

In addition to checking an activity level of communication interface280, host component202may check usage of memory230. When memory capacity exceeds a predetermined threshold level (e.g., b95% of memory230is full), host component202may take memory-related remedial actions (Acts405and406). These actions may include, for example, shutting down inactive processes (often referred to as zombie processes).

Host component202may also check processor usage. When the load on processor220is above a predetermined threshold (e.g., 90% of total processor capacity), host component220may take remedial actions (Acts408and409). These actions may be similar to the actions taken in Act406, and may include, for example, shutting down inactive processes or shutting down lower priority processes.

Host component202may also check the capacity of storage device250, such as a hard disk drive(s). When storage device250has exceeded a predetermined threshold capacity (e.g., 95% of capacity), host component220may again take remedial action, (Acts411and412), such as redirecting future disk write commands to console (i.e., to a monitor) or compressing non-critical files, such as log files.

Host component202may alert administrators of the actions taken in Acts403,406,409, and412(Act413). The alert may take the form of an e-mail, a pager notice, or a screen alert to an operator. Additionally, host component202may transmit an indication of the alert to a remote computer (Act414). More particularly, consistent with an aspect of the invention, console component203, residing at the remote computer, may receive the alert. Console component203may be configured to receive and monitor alerts from a number of host components202running on a number of different servers103. This aspect of the invention is described in more detail below.

One of ordinary skill in the art will recognize that commands to check processor load, storage device load, and network connection load are well known, and are thus not described in detail herein.

FIG. 5is a diagram illustrating an implementation of console component203consistent with aspects of the invention. Console component203may execute on a computing device504, such as a server computer103, and communicate with one or more host components202. As shown inFIG. 5, console component203is connected to a number of host components202, executing at servers501-503.

Servers501and502may be a group of clustered servers that are connected locally or through a local area network to console component203. Server503may be coupled remotely to console component203via wide area network510.

Each of host components202may operate to transmit information relating to their generated alerts (seeFIG. 4, Act414). Operators local to console component203may view the alert information from multiple host components202and manage threshold settings for the host components202.

FIG. 6is a diagram illustrating an exemplary graphical user interface (GUI)600that may be displayed by console component203. GUI600may include an output section601and input section610. Console component203may display alerts received from host components202to output section601. In input section610, operators may change configuration information, such as the threshold values, for a particular host component202. Input section610may include a selection box611through which the user may select the host component202that the user is configuring. As shown inFIG. 6, the host component202at the server called “Server3” is being configured. Input section610may additionally include input boxes612-615for inputting threshold information relating to the memory usage threshold, the processor usage threshold, the connection threshold, and the disk usage threshold, respectively.

In addition to merely monitoring and logging resource alerts from host components202, console component203may provide analysis and resource management functions. For example, console component203may correlate resource alerts from multiple host components202. If a number of host components202generate similar resource alerts at approximately the same time, this may indicate that a concerted DoS attack is being performed against these computers. Console component203may then output information to a user indicating a possible DoS attack.

In some implementations, console component203may reallocate resources among servers based on alerts received from host components202. For example, if host component202at server501issues a disk resource alert, console component203may instruct server501to begin using the disk resources of server502.

CONCLUSION

The CHAINS components described above operate to ensure that servers do not crash because of issues relating to resource overload. By constantly monitoring resources of various servers and throttling back resource access when the resources of a server are over taxed, the CHAINS component helps to ensure that the server will continue to operate.

Sometimes the best method for preventing attacks such as DoS and DDoS attacks is to prevent the attack from occurring in the first place. By keeping servers under DoS and DDoS attacks from failing, an attacker may give up and move on to a more susceptible target.

The foregoing description of preferred embodiments of the invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention. Moreover, while a series of acts have been presented with respect toFIG. 4, the order of the acts may be different in other implementations consistent with the present invention. Moreover, non-dependent acts may be performed in parallel.

Certain portions of the invention have been described as software that performs one or more functions. The software may more generally be implemented as any type of logic. This logic may include hardware, such as an application specific integrated circuit or a field programmable gate array, software, or a combination of hardware and software.