System and method for detecting slowloris-type attacks using server application statistics

A system and computer-implemented method to detect a slowloris-type network attack, wherein the method includes receiving data gathered by a server of a network over time, the data received including data about timing of requests from a plurality of clients received by the server, tracking the data about timing of requests over time, determining one or more characteristics about distribution of the data tracked, tracking the one or more characteristics to determine whether there is an increase in time for reading, by the server, a larger portion of requests tracked, identifying a change in the characteristics that indicates the presence of a slowloris-type network attack, and performing an action, in response to the change, to at least one of generate an alert about the slowloris-type network attack, request mitigation of the slowloris-type network attack, and mitigate the slowloris-type network attack.

FIELD OF THE INVENTION

The present technology relates to detection of slowloris-type attacks, and more particularly to detection of slowloris-type attacks using server application statistics.

BACKGROUND OF THE INVENTION

Early detection of network attacks can be evasive. Early detection of network attacks is key to avoiding network or server downtime. Failure of a server can cause a loss of data and/or a loss of consumer confidence.

Network monitoring for attacks can be performed by deploying intercept devices, such as taps, port mirrors, and/or probes, and/or adding capabilities to existing network devices, such as routers and/or switches. The intercept devices can intercept packets of network traffic, perform deep packet inspection (DPI), and/or collect flow summaries. However, deployment, configuration, and upkeep of the intercept devices can be cumbersome and consume many human and/or computing resources. Furthermore, in many situations deployment of intercept devices cannot be performed due to inaccessibility to the network to be monitored.

As an example, slowloris network attacks are difficult to detect in early stages. Slowloris is a type of denial of service attack tool in which a single client opens connections to a target web server and sends partial requests. Periodically, the client sends subsequent HTTP headers, adding to, but without completing, the request. Affected servers keep these connections open, allowing their maximum concurrent connection pool to be saturated such that connection attempts from clients are denied. Slowloris affects certain types of servers, whereas similar attacks, referred to herein as slowloris-type attacks, can affect different types of servers.

Such conventional methods and systems have generally been considered satisfactory for their intended purpose. However, there is still a need in the art for a method to detect, alert, and take countermeasures for network attacks against servers without the need to deploy intercept devices or perform deep packet inspection.

SUMMARY OF THE INVENTION

The purpose and advantages of the below described illustrated embodiments will be set forth in and apparent from the description that follows. Additional advantages of the illustrated embodiments will be realized and attained by the devices, systems and methods particularly pointed out in the written description and claims hereof, as well as from the appended drawings.

To achieve these and other advantages and in accordance with the purpose of the illustrated embodiments, in one aspect, disclosed is a computer-implemented method to detect a slowloris-type network attack. The method includes receiving data gathered by a server of a network over time, the data received including data about timing of requests from a plurality of clients received by the server, tracking the data about timing of requests over time, determining one or more characteristics about distribution of the data tracked, tracking the one or more characteristics to determine whether there is an increase in time for reading, by the server, a larger portion of requests tracked, identifying a change in the characteristics that indicates the presence of a slowloris-type network attack, and performing an action, in response to the change, to at least one of generate an alert about the slowloris-type network attack, request mitigation of the slowloris-type network attack, and mitigate the slowloris-type network attack.

In accordance with embodiments, tracking the data about timing of the requests includes identifying events in the received data that are requests to the server, and determining for each request an amount of time since the beginning of a most recent request.

In accordance with further embodiments, determining the one or more characteristics about distribution of the data tracked includes generating a normal distribution of the data about timing of requests and determining the mean and standard deviation of the normal distribution.

In addition, in accordance with embodiments, tracking the one or more characteristics includes continuously updating the normal distribution as the received data is received over time, continuously updating the mean and standard deviation of the normal distribution over time, identifying when the mean of the normal distribution grows larger over time, and identifying when the standard deviation of the normal distribution grows smaller over time.

In accordance with embodiments, identifying the change in the characteristics that indicates the presence of a slowloris-type network attack includes determining that both the mean of the normal distribution grows larger over time and the standard deviation of the normal distribution grows smaller over time.

Furthermore, in accordance with embodiments, performing the action includes mitigating the slowloris-type network attack.

In accordance with further embodiments, receiving the data further includes receiving data from data sources included in the network that operate on data of the network independent of data inspection performance.

In accordance with embodiments, tracking the data about timing of requests, determining the one or more characteristics about distribution, tracking the one or more characteristics, and identifying the change in the characteristics are performed per client submitting requests of the requests received by the server.

In addition, in accordance with embodiments, performing the action includes blacklisting a client identified as having submitted requests associated with a distribution for which the change in the characteristic was identified.

Furthermore, in accordance with embodiments, the network includes a plurality of servers, and the method further includes receiving data gathered by the plurality of servers of the network over time, the data received including data about timing of requests from a plurality of clients received by each of the servers, tracking, for each of the servers, the data about timing of requests over time, determining, for each of the servers, one or more characteristics about distribution of the data tracked, tracking, for each of the servers, the one or more characteristics to determine whether there is an increase in time for reading, by the server, a larger portion of requests tracked, identifying, for each of the servers, a change in the characteristics that indicates the presence of a slowloris-type network attack targeting the server, and performing an action, in response to the change, to at least one of generate an alert associated with each targeted server about the slowloris-type network attack, request mitigation of the slowloris-type network attack for the targeted server, and mitigate the slowloris-type network attack for the targeted server.

In accordance with another aspect of the disclosure, a system is provided to detect a slowloris-type network attack. The system includes a memory configured to store instructions and a processor disposed in communication with the memory. The processor upon execution of the instructions is configured to perform the operations of the method described.

In accordance with still another aspect of the disclosure, a non-transitory computer readable storage medium and one or more computer programs embedded therein are provided. The computer programs include instructions, which when executed by a computer system, cause the computer system to perform the operations of the method.

In accordance with still another aspect of the disclosure, a computer-implemented method to detect network attacks is provided. The method includes receiving data gathered by one or more servers of a network over time, the data received including data about network traffic exchanged with the one or more servers, tracking the data about the network traffic over time, determining one or more characteristics about distribution of the data tracked, tracking the one or more characteristics, determining whether a change in the characteristics indicates a network attack, and performing an action to at least one of generate an alert about the network attack, request mitigation of the network attack, and mitigate the network attack.

DETAILED DESCRIPTION OF CERTAIN EMBODIMENTS

Reference will now be made to the drawings wherein like reference numerals identify similar structural features or aspects of the subject disclosure. For purposes of explanation and illustration, and not limitation, a block diagram of an exemplary embodiment of a network system having a network attack monitor104in accordance with the disclosure is shown inFIG. 1and is designated generally by reference character100. Other embodiments of the network attack monitor140in accordance with the disclosure, or aspects thereof, are provided inFIGS. 2-8, as will be described.

It must be noted that as used herein and in the appended claims, the singular forms “a”, “an,” and “the” include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to “a stimulus” includes a plurality of such stimuli and reference to “the signal” includes reference to one or more signals and equivalents thereof known to those skilled in the art, and so forth. It is to be appreciated the embodiments of this disclosure as discussed below are implemented using a software algorithm, program, or code that can reside on a computer useable medium for enabling execution on a machine having a computer processor. The machine can include memory storage configured to provide output from execution of the computer algorithm or program.

As used herein, the term “software” is meant to be synonymous with any logic, code, or program that can be executed by a processor of a host computer, regardless of whether the implementation is in hardware, firmware or as a software computer product available on a disc, a memory storage device, or for download from a remote machine. The embodiments described herein include such software to implement the equations, relationships, and algorithms described above. One skilled in the art will appreciate further features and advantages of the disclosure based on the above-described embodiments. Accordingly, the disclosure is not to be limited by what has been particularly shown and described, except as indicated by the appended claims.

Description of certain illustrated embodiments of the present disclosure will now be provided. With reference now toFIG. 1, network system100includes one or more network servers102that are monitored by a network attack monitor104. A plurality of clients108communicate with the servers102. Each client108can communicate with one or more of the servers102. Each server102includes a processing device105that includes a statistic gathering module106. The statistics gathering module gathers statistics about operation of the server102. The network attack monitor104receives, via communication links110, statistics data generated by the statistic gathering modules106of the various servers102. The communication between the statistic gathering module106and the network attack monitor104can be direct, such as via wired or wireless communication, or indirect, such as via one or more networks112. The servers102(and their respective processing devices105) can communicate with the network112via one or more routers114.

The clients108can be processing devices, such as end user devices, sensors, appliances, microprocessors, servers, etc., that communicate with the servers102via communication links110in a client/server relationship. These communication links110can be wireless links, wired communication links, or a combination thereof. Additionally, the communication links110can traverse one or more networks, such as network112. An end user device is a source or destination of a communication sent via network(s)112that interfaces between a user and a network, such as network112. Examples of user end devices102ainclude mobile computing devices (e.g., smart phones, tablets, or laptop computers), desk top computers, computer terminals, web-connected machines or consumer devices, web-connected sensors, point-of-sale (POS) terminals, machines on manufacturing assembly lines, etc.

The servers102can be, for example, web servers, application servers, communication servers, banking servers, securities trading servers, etc. Slowloris attacks target servers that use a protocol that allows for large client messages capable of accommodating HTTP headers that are added to client messages during subsequent transmissions. A webserver is a computer system that processes requests via Hypertext Transfer Protocol (HTTP), to serve the files that form Web pages to users, in response to their requests, such as for web browsing or providing single page applications (SPAs). An application server can provide a service to end devices102. Examples of application servers include media servers for providing a media service (e.g., streaming video or audio); voice over internet servers for providing voice over internet services; data analysis servers for collecting and analyzing data from e.g., sensors; configuration servers for (re-)configuring an end device; and transaction servers for processing a transaction. Examples of such transactions include, for example and without limitation, retail purchases, banking transactions, and securities transactions. A communication server can be an open, standards-based computing system that operates as a carrier-grade common platform for a wide range of communications applications, such as to transfer files or access information on systems or networks at remote locations over telecommunication links. Banking servers and securities trading servers can be servers that specialize in particular types of secure transactions and user services. Some example servers include Apache®, Lighttpd, and NGINX® web servers, all of which are open source web servers. The disclosure is not limited to open source web servers, but can encompass other servers, such as privately owned or closed licensed servers.

Statistic gathering module106includes one or more modules that are included with the server102, such as to track statistics about received requests. The statistic gathering module106can be a standard module provided with software executed by the server102. For example a web server such as Apache® includes a module mod_status that gathers statistics about server load and performance. These statistics can be obtained using deep packet inspection (DPI). The statistics can be general for all network traffic exchanged by the corresponding server102, can be specific to clients or groups of clients exchanging network traffic with the server102, and/or can be specific to a direction of the network traffic. Of note is that the DPI is performed by the statistic gathering module106of the server102, as opposed to intercept devices disposed in the network system100or other network devices of the network system100.

The statistics gathering module106can obtain data from additional data sources, such as standard modules that perform IP accounting (e.g., systemd) or present system information about file system processes associated with an operating system, such as information about processes in a file-like structure (for example procfs). For example, the statistics can track processes that are running, such as using the ps or top commands in a server102executing a LINUX® operating system. The statistics gathering module106can communicate the statistics to an outside party, such as network attack monitor104.

Network attack monitor104is a processing device that can have a user interface and/or attack mitigation capabilities. For example, the network attack monitor can be an end user device or a local or cloud-based network and/or attack mitigation system. In embodiments the network attack monitor104is a computing device running SP, APS, or TMS software, available from Arbor Inc. of Burlington, Mass. In embodiments, the network attack monitor104is a user end device, such as a smart phone, executing an application, e.g., a user-defined plugin, to communicate with the statistic gathering module106and perform the functions described in the disclosure.

Each network112can be, without limitation, a private or public network that uses wired and/or wireless communication links. The public network can include, for example, a network such as the Internet, a different public network, a cellular network, a public switched telephone network (PSTN), etc. The private network can include, for example, a personal communication service (PCS) network, a LAN, a WAN, a VLAN, etc.

Each of servers102, network attack monitor104, and clients108may be a special purpose computing device or a software component (not limited to a single process) dedicated to its corresponding functions related to monitoring data communicated via the network(s)112. For example, servers102, network attack monitor104, and clients108can execute object oriented programs that define classes, which are non-modifiable once defined, thus forming a virtual machine. Objects are executed as instances of a class. The objects can be interactive objects that include attributes with quantifiable values and functions that are invoked by values. The values can be received as input or from other objects. Alternatively, each of servers102, network attack monitor104, and clients108may be a general purpose computing device with specialized software components installed thereon.

FIG. 2shows a block diagram of an example network monitor system200that includes a distribution module202, an attack detection module204, an alert module206, and a mitigation module208, a blacklist module210, and a user interface module212.

The distribution module202receives the statistics data from statistics gathering modules106of one or more severs102. The statistics data can include information for each communication attempt that begins with a request from a client108to the corresponding server102, including the mode of request (M), seconds since beginning the most recent request (SS), and client identification (IP address (v4 or v6)). Using these statistics data, the distribution module202calculates for a predetermined time interval, a number of seconds spent reading (SSR) in response to the respective requests. The SSR equals the total SS currently being processed for read requests, wherein a read request is indicated by M=R. SSR can be calculated for respective clients and/or for all requests. The distribution module202uses a windowing function to calculate min, max, and average SSR values for the predetermined time interval. Min, max, and average can be determined for all servers102as a total and/or for individual servers102for the predetermined time interval. Additionally or alternatively, min, max, and average can be determined per client communicating with one or more specific servers102or for all servers102.

The amount of statistics data received and analyzed by the distribution module202can grow into a large dataset over the course of the predetermined time interval. Once sufficient data has been accumulated, the distribution module202calculates a normal distribution as a streaming window function, also referred to as a streaming normal distribution.

In embodiments, the predetermined time interval is used to indicate that sufficient data has been accumulated. Examples of default time intervals could range from a single day to a week. Using such a default time interval, the data accumulated would be whatever data was accumulated during the interval.

In embodiments, a the distribution module202is configured with a predetermined time interval, a number of histograms NH that sets the number of histograms to be calculated, and a threshold error rate. to calculate histograms for the mean and standard deviation for an error rate. In an example, default values set the predetermined interval equal to 1 day, NH=24, and the threshold error rate equal to 90%. Using these defaults, sufficient data accumulation would be indicated once 24 (NH) consecutive (1-hour) histograms for 1 day (the predetermined time interval) had an error rate below 90% (the threshold error rate).

The mean (μ) and standard deviation (σ) are determined for the streaming normal distribution, such as at regular time intervals. The distribution module can determine the streaming normal distribution, μ, and σ for all servers102as a total, for individual servers102, per client communicating with one or more specific servers102, and/or per client for all servers102.

The attack detection module204tracks μ and σ and determines whether changes of the tracked μ and σ meet a predetermined condition that indicates the presence of a slowloris-type attack. The predetermined condition can be that an amount by which μ shifts larger exceeds a first predetermined threshold, and an amount by which σ shifts smaller exceeds a second predetermined threshold. When the tracked μ and σ meet the predetermined condition, it indicates that a large enough percentage of the requests received by a server102are being read for a large enough amount of time, as would be consistent with behavior during a slowloris attack. The attack detection module204can track μ and σ and detect the presence of an attack, such as the slowloris-type attack, for all servers102as a total, for individual servers102, per client communicating with one or more specific servers102, and/or per client for all servers102.

Upon determining that the tracked μ and σ meet the predetermined condition, the attack detection module204notifies the alert module206, the mitigation module208, and/or the blacklist module210that the presence of an attack has been detected. The notification can identify the particular attack, which in the present example is the slowloris-type attack. The notification can also identify any specific servers102or clients108for which the presence of the attack was detected.

Upon notification from the attack detection module204that the presence of an attack has been detected, the alert module206sends an alert to the server(s)102affected by the attack or to a device (e.g., a mobile or stationary device) operated by an administrator of the affected server(s)102. The alert can also be indicated to a user of the network attack monitor104, e.g., via a graphical user interface (GUI) provided by a user interface of the network attack monitor104. The alert indicates that the presence of an attack has been detected, and can further identify the attack. The alert can include, for example, a push notification, an electronically mailed message such as using simple mail transfer protocol (SMTP), a text message such as provided by a multimedia messaging service (MMS) or short message service (SMS), a graphically displayed alert, an audio alert, a vibratory alert, etc. The alert can be sent to the server(s)102via a direct connection or a private network (e.g., a LAN, WAN, or VLAN), or via a public network (e.g., the Internet and/or a cellular network).

Upon notification from the attack detection module204that the presence of an attack has been detected, the mitigation module208performs a mitigation action or requests a mitigation action. The mitigation action can be applied, for example, to network traffic to all servers102, from an identified client108, or to an identified server102. Examples of mitigation actions include identifying the traffic to be mitigated versus legitimate traffic, blocking the identified traffic, applying traffic filters that drop traffic with specific characteristics, forwarding the legitimate traffic. Blocked attack traffic is not transmitted as network traffic to its intended destination, whereas forwarded legitimate traffic is transmitted as network traffic to its intended destination.

Upon notification from the attack detection module204that the presence of an attack has been detected that identifies one or more clients108, the blacklist module210adds or requests addition of a blacklist entry of the IP address of the one or more identified clients108to a blacklist. The blacklist can be applied by a router or other network device that can filter or block network traffic. When an IP address is blacklisted, future traffic from the same IP address will be blocked.

The user interface module212can receive user input data by interfacing with user input devices, such as a keyboard, pointing device (e.g., mouse), touch screen, etc. Additionally, the user interface module216interfaces with user output devices, such as a display monitor, audio speakers, vibration devices, and/or a printer, for outputting visualizations of data (e.g., the received statistics data and/or the normal distribution) and alarms to a user. Thus, the user interface module212provides an interface for exchanging data between a user and the network attack monitor104.

FIG. 3shows an embodiment in which the functionality of the network attack monitor104can be shared with a cloud-based protection system304. Integration between the network attack monitor104and the cloud-based protection system304can be seamless for detecting attacks, such as slowloris-type attacks, issuing alerts, and optionally implementing countermeasures, such as mitigation and/or blacklisting. The network attack monitor104is provided local to one or more servers102, meaning the network attack monitor104is included within the same premises network308as the servers102. The premises network308communicates with the Internet310via router(s)114and communication links110, which facilitates communication between clients108and servers102. The network attack monitor104communicates with the cloud-based protection system304via communication links314. In embodiments, the communication between the network attack monitor104and the cloud-based protection system304via communication links314uses Cloud Signaling by Arbor Networks Inc., of Burlington, Mass., as described in U.S. Pat. No. 9,432,385, assigned to Arbor Networks Inc., which is incorporated by reference herein in its entirely. The network attack monitor104can detect an attack, such as a slowloris-type attack, as described in connection with network attack monitor104.

When an attack is detected, the network attack monitor104can notify the cloud-based protection system304to perform all or a portion of the functions performed by the alert module206, the mitigation module208, and/or the blacklist module210. In embodiments, the cloud-based protection system304can perform all or a portion of the functions performed by the distribution module202and/or the attack detection module204.

For example, when the statistics dataset received by the distribution module202or the scale of a detected attack exceeds a relevant threshold measurement, the cloud-based protection system304can take-over or share with the functions performed by any of modules202-212. When the relevant threshold measurement is exceeded, the network attack monitor104can submit a request for cloud-based help by the cloud-based protection system304, which will enlist upstream help. The cloud-based system protection system304can apply countermeasures on a larger scale than may be possible for the network attack monitor104. Accordingly, the amount of traffic filtering or blacklisting that needs to be performed by the network attack monitor104may be within the scope of the network attack monitor104, e.g., until the slack ends or slows down, after which help can be requested again, such as if another attack is launched or a different target is targeted.

An example of requesting help by a premises-based protection system from a cloud-based protection system is described in U.S. patent application Ser. No. 15/399,368, filed Jan. 5, 2017, entitled A SYSTEM AND METHOD TO IMPLEMENT CLOUD-BASED THREAT MITIGATION FOR IDENTIFIED TARGETS, assigned to Arbor Networks Inc., which is incorporated herein by reference.

FIG. 4shows a similar example to the example shown inFIG. 3, wherein the network attack monitor104monitors several remote servers102, each of which may be operating within its own premises network308. The network attack monitor104can communicate with the servers102via communication links110, which may traverse a network, such as the Internet. The network attack monitor104and cloud-based protection system304can share functionality as described with respect toFIG. 3.

With reference now toFIGS. 5-7, shown are flowcharts demonstrating implementation of the various exemplary embodiments. It is noted that the order of operations shown inFIGS. 3 and 4is not required, so in principle, the various operations may be performed out of the illustrated order or in parallel. Also certain operations may be skipped, different operations may be added or substituted, or selected operations or groups of operations may be performed in a separate application following the embodiments described herein.

FIGS. 5-7illustrate operations of an example method performed by a network attack monitor, such as network attack monitor104shown inFIG. 1. With reference toFIG. 5, at operation502, data gathered by the one or more servers over time is received. The data received can include data about timing of requests from a plurality of clients received by each of the servers. At operation504, for each of the servers, the data about timing of requests over time is tracked. In embodiments, tracking of the data about timing of the requests can include identifying events in the received data that are requests to the server and determining for each request an amount of time since the beginning of the most recent request.

At operation506, for each of the servers, one or more characteristics about distribution of the data tracked is determined. At operation508, for each of the servers, the one or more characteristics is tracked. This tracking can indicate whether there is an increase in time for reading, by the server, a larger portion of requests tracked. At operation510, for each of the servers, it is determined whether there is a change in the characteristics that indicates the presence of a network attack, such as a slowloris attack, targeting the server. If the determination at operation510is YES, indicating that there is such a change that is indicative of the presence of the network attack, then one or more of operations512,514, and516are performed, after which the method includes performing operation518.

At operation512, an alert about the network attack is generated in association with each server for which there is an indication that the server is targeted. At operation514, either mitigation is requested or mitigation is performed for mitigating the network attack for the server(s) that are indicated as being targeted. At operation516, each client identified as having submitted requests associated with a distribution for which the change in the characteristic was identified is blacklisted. At operation518, the network attack monitor continues to receive the data gathered by the one or more servers over time, after which the method performs operation508.

With reference toFIG. 6, in embodiments, the network attack monitor performs operations602-612in place of operations504-510shown inFIG. 5. In these embodiments, operation602is executed following execution of operation502. At operation602, a normal distribution is generated of the data about timing of requests. At operation604, the mean and standard deviation of the normal distribution is determined. At operation606, the normal distribution is continuously updated as the received data is received over time. At operation608, the mean and standard deviation of the normal distribution is continuously updated over time. At operation610, a determination is made whether the mean of the normal distribution is growing larger over time. If the determination at operation610is YES, meaning the mean of the normal distribution is growing larger over time, the method continues at operation612. Else, if the determination at operation at610is NO, meaning the mean of the normal distribution is not growing larger over time, the method continues at operation518in which the data gathered by the one or more servers is continued to be received over time, after which the method continues at operation606.

At operation612, a determination is made whether the standard deviation of the normal distribution is growing larger over time. If the determination at operation is YES, meaning the standard deviation of the normal distribution is growing larger over time, the method continues with performance of any one or more of operations512,514, and516, after which operation518is performed, after which the method continues at operation606. Else, if the determination at operation612is NO, meaning the normal distribution is not growing larger over time, the method continues at operation518, after which the method continues at operation606.

FIG. 7shows an example method performed, in embodiments, by the network attack monitor. At operation702, data gathered by one or more servers of a network is received over time, wherein the data received includes data about network traffic exchanged with the one or more servers. At operation704, the data about the network traffic is tracked over time. At operation706, one or more characteristics about distribution of the data tracked is determined. At operation708, the one or more characteristics is tracked. At operation710, a determination is made whether a change in the characteristics indicates the presence of a network attack targeting one or more of the servers.

If the determination at operation710is YES, indicating that there is such a change that is indicative of the presence of a network attack, then one or more of operations712,714, and716are performed, after which the method includes performing operation718.

At operation712, an alert about the network attack is generated in association with each server for which there is an indication that the server is targeted. At operation714, either mitigation is requested or mitigation is performed for mitigating the network attack for the server(s) that are indicated as being targeted. At operation716, each client is blacklisted that was identified as being associated with causing the change in the characteristic. At operation718, the network attack monitor continues to receive the data gathered by the one or more servers over time, after which the method performs operation708.

Embodiments processing performed by the network attack monitor104shown inFIG. 1may be implemented or executed by one or more computer systems. For example, processing performed by the network attack monitor104can be implemented using a computer system such as example computer system802illustrated inFIG. 8. In various embodiments, computer system802may be a server, a mainframe computer system, a workstation, a network computer, a desktop computer, a laptop, or the like, and/or include one or more of a field-programmable gate array (FPGA), application specific integrated circuit (ASIC), microcontroller, microprocessor, or the like.

Computer system802is only one example of a suitable system and is not intended to suggest any limitation as to the scope of use or functionality of embodiments of the disclosure described herein. Regardless, computer system802is capable of being implemented and/or performing any of the functionality set forth hereinabove.

Computer system802may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, and so on that perform particular tasks or implement particular abstract data types. Computer system802may be practiced in distributed data processing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed data processing environment, program modules may be located in both local and remote computer system storage media including memory storage devices.

Computer system802is shown inFIG. 8in the form of a general-purpose computing device. The components of computer system802may include, but are not limited to, one or more processors or processing units816, a system memory828, and a bus818that couples various system components including system memory828to processor816.

Computer system802typically includes a variety of computer system readable media. Such media may be any available media that is accessible by the network attack monitor104, and it includes both volatile and non-volatile media, removable and non-removable media.

Program/utility840, having a set (at least one) of program modules815, such as the distribution module202, the attack detection module204, the alert module206, the mitigation module208, the blacklist module210, and the user interface module212may be stored in memory828by way of example, and not limitation, as well as an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data or some combination thereof, may include an implementation of a networking environment. Program modules815generally carry out the functions and/or methodologies of embodiments of the disclosure as described herein.

Computer system802may also communicate with one or more external devices814such as a keyboard, a pointing device, a display824, etc.; one or more devices that enable a user to interact with computer system802; and/or any devices (e.g., network card, modem, etc.) that enable the network attack monitor104to communicate with one or more other computing devices. Such communication can occur via Input/Output (I/O) interfaces822. Still yet, computer system802can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and/or a public network (e.g., the Internet) via network adapter820. As depicted, network adapter820communicates with the other components of the network attack monitor104via bus818. It should be understood that although not shown, other hardware and/or software components could be used in conjunction with computer system502. Examples, include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

Potential advantages provided by the disclosed method and system include the ability to detect, alert, and take countermeasures for network attacks, such as slowloris-type network attacks, against servers by leveraging statistics that is already generated by the servers. By using these statistics, there is no need to deploy intercept devices or perform deep packet inspection. Additionally, the method can be performed by using user programmable tools, such as a Python® plugin, including obtaining the statistics data from a statistics gathering module of the respective servers and analyzing the statistics data. The network attack monitor can operate locally, remotely, and/or with cloud-based support, such as for countermeasures, e.g., mitigation or blacklisting operations. The method can be included with a DDoS Open Threat Signaling (DOTS) implementation.

The techniques described herein are exemplary, and should not be construed as implying any particular limitation of the certain illustrated embodiments. It should be understood that various alternatives, combinations, and modifications could be devised by those skilled in the art. For example, operations associated with the processes described herein can be performed in any order, unless otherwise specified or dictated by the operations themselves. The present disclosure is intended to embrace all such alternatives, modifications and variances that fall within the scope of the appended claims.

Although the systems and methods of the subject disclosure have been described with respect to the embodiments disclosed above, those skilled in the art will readily appreciate that changes and modifications may be made thereto without departing from the spirit and scope of the certain illustrated embodiments as defined by the appended claims.