Abstract:
A console host and intrusion negation system (CHAINS) includes a host component [ 202 ] and a console component [ 203 ]. The host component [ 202 ] monitors resources at a server [ 501 - 503 ]. Resources that are becoming overloaded can be throttled back. Reports relating to resource usage may be transmitted to the console component. At the console component, resource reports from multiple host components may be viewed and managed.

Description:
RELATED APPLICATIONS  
       [0001]    This application is related to the concurrently-filed application (attorney Docket No. 02-4006), Ser. No. ______, titled “Systems and Methods For Preventing Intrusion at a Web Host.” 
     
    
     
       BACKGROUND OF THE INVENTION  
         [0002]    A. Field of the Invention  
           [0003]    The present invention relates generally to computer networks, and more particularly, to resource management of server computers in a public network, such as the Internet.  
           [0004]    B. Description of Related Art  
           [0005]    Network computer servers, such as computers that transmit HTML (HyperText Markup Language) documents to client computing devices on the Internet, may interact and receive data requests from many different end-users. It is frequently important that these computer servers maintain high levels of uptime. For example, if a server for an e-commerce site fails to respond to user requests, the site may lose sales.  
           [0006]    There are many reasons why a server, or a group of servers, may fail. For example, the server may experience software or hardware errors that cause the server to fail. Additionally, the server may experience resource-related problems, such as too many users trying to simultaneously communicate with the server. Such resource-related problems can be “natural” resource problems in which too many bona fide users are trying to access the system simultaneously or malicious problems such as denial of service (DoS) or distributed denial of service (DDoS) attacks. In a DoS or DDoS attack, a compromised system or a multitude of compromised systems flood a server with incoming messages in an attempt to overwhelm the available server resources. Legitimate users of the server may then be denied service by the server due to the overload of its resources.  
           [0007]    Accordingly, server system availability is an important concern for network servers, such as Internet servers. Conventional hardware solutions, such as clustering and failover, offer some assurances in this area by offering more resources to the users. However, these solutions can fail when faced with automated DoS and DDoS attacks that simply keep taking resources.  
           [0008]    Accordingly, there is a need in the art to improve resource management in the face of attacks on system resources.  
         SUMMARY OF THE INVENTION  
         [0009]    Systems and methods consistent with the principles of this invention implement a console host intrusion negation system (CHAINS) that monitors selected resources on one or more computer servers and throttles back resource usage when a server resource is overburdened.  
           [0010]    A method consistent with an aspect of the invention includes monitoring resources associated with a network server and comparing activity levels of the resources to predetermined threshold activity levels. The method further includes reducing usage of one of the resources when the activity level associated with the resource increases above the predetermined threshold activity level.  
           [0011]    A second aspect consistent with the invention is directed to a computer server that includes a processor, a communication interface, and a memory containing instructions. The instructions, when executed by the processor, cause the processor to monitor a usage level of the processor, the communication interface, and the memory. The instructions additionally compare the usage level of the communication interface to a first threshold and throttle back a number of active network connections when the usage level of the communication interface is greater than the first threshold; compare the usage level of the memory to a second threshold and shut down inactive processes when the usage level of the memory is above the second threshold; and compare the usage level of the processor to a third threshold and shut down inactive processes when the usage level of the processor is above the third threshold.  
           [0012]    Yet another aspect of the present invention is directed to a system that includes a number of first computing devices and a second computing device. The first computing devices include a host software component configured to monitor resources of the first computing device and throttle back resource usage when resources of the first computing devices are being used above predetermined threshold levels. The second computing device includes a console software component configured to display alerts when the resources of the first computing devices are being used above the predetermined threshold levels.  
           [0013]    Yet another aspect consistent with the present invention is directed to a method that includes displaying information relating to resources of remote computers, receiving information defining threshold levels for the resources at the remote computers, and transmitting the information defining the threshold levels for the resources to the remote computers. The remote computers throttle back resource usage when a resource usage level exceeds the threshold levels. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0014]    The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate the invention and, together with the description, explain the invention. In the drawings,  
         [0015]    [0015]FIG. 1 is a diagram illustrating an exemplary system in which concepts consistent with the invention may be implemented;  
         [0016]    [0016]FIG. 2 is a diagram of an exemplary computing device that may correspond to one of the servers in FIG. 1;  
         [0017]    [0017]FIG. 3 is a diagram conceptually illustrating the interaction of a host component with elements of the server shown in FIG. 2;  
         [0018]    [0018]FIG. 4 is a flow chart illustrating operation of a host component consistent with an aspect of the invention;  
         [0019]    [0019]FIG. 5 is a diagram illustrating an implementation of a console component consistent with aspects of the invention; and  
         [0020]    [0020]FIG. 6 is a diagram illustrating an exemplary graphical user interface (GUI) that may be displayed by the console component. 
     
    
     DETAILED DESCRIPTION  
       [0021]    The following detailed description of the invention refers to the accompanying drawings. The same reference numbers may be used in different drawings to identify the same or similar elements. Also, the following detailed description does not limit the invention. Instead, the scope of the invention is defined by the appended claims and equivalents of the claim features.  
         [0022]    As described below, a console host and intrusion negation system (CHAINS) monitors selected resources on one or more computer servers. Chains may include one or more host software components and a console software component. The host component resides on a server computer and monitors resource usage at the server. If a particular resource is used at a level above a preset threshold, the host component may take remedial action. The remedial action may include, for example, throttling back the resource or notifying a user via the console component.  
       SYSTEM OVERVIEW  
       [0023]    [0023]FIG. 1 is a diagram illustrating an exemplary system  100  in which concepts consistent with the present invention may be implemented. System  100  may include a number of end-user computing devices  101 A and  101 B, a network  102 , and server computers  103 A- 103 D (collectively referred to as servers  103 ). End-user computing devices  101  may include personal computers or the like through which users connect to network  102 . Network  102  may include any type of network, such as a local area network (LAN), a wide area network (WAN), a virtual private network (VPN), an intranet, the Internet, or a combination of networks. End-user computing devices  101  and servers  103  may connect to network  102  via wired, wireless, and/or optical connections.  
         [0024]    Servers  103  may respond to requests for information from end-user computing devices  101 . For example, servers  103  may be HTML servers that interact with end-user computing devices  101  through hyper-text transfer protocol (HTTP) sessions to transmit HTML web pages to users. Server  103  may include a cluster of servers, such as the three servers  103 A- 103 C contained in cluster  105 . The servers  103 A= 103 C in cluster  105  may include a load-balancing mechanism through which the servers may jointly handle requests from end-user computing devices  101  in such a manner as to balance the distribution of work among the servers in cluster  105 .  
         [0025]    [0025]FIG. 2 is a diagram of an exemplary computing device that may correspond to one of servers  103 . Server  103  may include bus  210 , processor  220 , main memory  230 , read only memory (ROM)  240 , storage device  250 , input device  260 , output device  270 , and communication interface  280 . Bus  210  permits communication among the components of server  103 .  
         [0026]    Processor  220  may include any type of conventional processor or microprocessor that interprets and executes instructions. Main memory  230  may include a random access memory (RAM) or another type of dynamic storage device that stores information and instructions for execution by processor  220 . ROM  240  may include a conventional ROM device or another type of static storage device that stores static information and instructions for use by processor  220 . Storage device  250  may include a magnetic and/or optical recording medium and its corresponding drive.  
         [0027]    Input device  260  may include one or more conventional mechanisms that permit an operator to input information to computing device  103 , such as a keyboard, a mouse, a pen, a number pad, a microphone and/or biometric mechanisms, etc. Output device  270  may include one or more conventional mechanisms that output information to the operator, including a display, a printer, speakers, etc. Communication interface  280  may include any transceiver-like mechanism that enables computing device  103  to communicate with other devices and/or systems. For example, communication interface  280  may include mechanisms for communicating with another device or system via a network, such as network  102 .  
         [0028]    In one implementation, main memory  230  may include computer programming instructions that implement a CHAINS host software component  202  and/or console software component  203 . The operation of host component  202  and console component  203  will be described in more detail below.  
       CHAINS  
       [0029]    [0029]FIG. 3 is a diagram conceptually illustrating the interaction of CHAINS host component  202  with resources associated with server  103 . In particular, host component  202  may interact with communication interface  280 , storage device  250 , memory  230 , and processor  220 . In general, these elements of server  103  can be considered to be resources of server  103 . Host component  202  monitors and controls the activity level of these resources.  
         [0030]    [0030]FIG. 4 is a flow chart illustrating operation of host component  202  consistent with an aspect of the invention. Host component  202  may begin by checking an activity level of communication interface  280 . This may include checking the number of open connections between server  103  and end-user computing devices  101 . An end-user computing device  101  that wishes to receive information from server  103  begins by transmitting a request for a connection with server  103 . Server  103 , in turn, can accept or reject the connection. Additionally, server  103  may keep track of the number of open connections at any particular time.  
         [0031]    Host component  202  maintains a threshold level relating to the activity level of communication interface  280 . The threshold level may be set by a user either locally at server  103  or, as will be described in more detail below, from a remote computer running console component  203 . The threshold level may be derived manually by the user, or automatically, based on historical activity levels. Host component  202  may check to determine whether the activity level of communication interface  280  is above the threshold (Act  402 ). If it is, host component  202  may take remedial actions to effectively throttle back the number of active connections (Act  403 ). Such actions can include closing open connections. For example, host component  202  may first close connections that are open but inactive. If the number of connections is still too high, host component  202  may close connections that the server  103  classifies as lower priority connections. If the number of connections is still too high, host component  202  may begin to randomly close open connections. In addition, while the number of open connections is above the threshold, host component  202  may refuse any new connection requests from end-user computing devices  101 .  
         [0032]    In addition to checking an activity level of communication interface  280 , host component  202  may check usage of memory  230 . When memory capacity exceeds a predetermined threshold level (e.g., b  95 % of memory  230  is full), host component  202  may take memory-related remedial actions (Acts  405  and  406 ). These actions may include, for example, shutting down inactive processes (often referred to as zombie processes).  
         [0033]    Host component  202  may also check processor usage. When the load on processor  220  is above a predetermined threshold (e.g., 90% of total processor capacity), host component  220  may take remedial actions (Acts  408  and  409 ). These actions may be similar to the actions taken in Act  406 , and may include, for example, shutting down inactive processes or shutting down lower priority processes.  
         [0034]    Host component  202  may also check the capacity of storage device  250 , such as a hard disk drive(s). When storage device  250  has exceeded a predetermined threshold capacity (e.g., 95% of capacity), host component  220  may again take remedial action, (Acts  411  and  412 ), such as redirecting future disk write commands to console (i.e., to a monitor) or compressing non-critical files, such as log files.  
         [0035]    Host component  202  may alert administrators of the actions taken in Acts  403 ,  406 ,  409 , and  412  (Act  413 ). The alert may take the form of an e-mail, a pager notice, or a screen alert to an operator. Additionally, host component  202  may transmit an indication of the alert to a remote computer (Act  414 ). More particularly, consistent with an aspect of the invention, console component  203 , residing at the remote computer, may receive the alert. Console component  203  may be configured to receive and monitor alerts from a number of host components  202  running on a number of different servers  103 . This aspect of the invention is described in more detail below.  
         [0036]    One of ordinary skill in the art will recognize that commands to check processor load, storage device load, and network connection load are well known, and are thus not described in detail herein.  
         [0037]    [0037]FIG. 5 is a diagram illustrating an implementation of console component  203  consistent with aspects of the invention. Console component  203  may execute on a computing device  504 , such as a server computer  103 , and communicate with one or more host components  202 . As shown in FIG. 5, console component  203  is connected to a number of host components  202 , executing at servers  501 - 503 .  
         [0038]    Servers  501  and  502  may be a group of clustered servers that are connected locally or through a local area network to console component  203 . Server  503  may be coupled remotely to console component  203  via wide area network  510 .  
         [0039]    Each of host components  202  may operate to transmit information relating to their generated alerts (see FIG. 4, Act  414 ). Operators local to console component  203  may view the alert information from multiple host components  202  and manage threshold settings for the host components  202 .  
         [0040]    [0040]FIG. 6 is a diagram illustrating an exemplary graphical user interface (GUI)  600  that may be displayed by console component  203 . GUI  600  may include an output section  601  and input section  610 . Console component  203  may display alerts received from host components  202  to output section  601 . In input section  610 , operators may change configuration information, such as the threshold values, for a particular host component  202 . Input section  610  may include a selection box  611  through which the user may select the host component  202  that the user is configuring. As shown in FIG. 6, the host component  202  at the server called “Server 3 ” is being configured. Input section  610  may additionally include input boxes  612 - 615  for inputting threshold information relating to the memory usage threshold, the processor usage threshold, the connection threshold, and the disk usage threshold, respectively.  
         [0041]    In addition to merely monitoring and logging resource alerts from host components  202 , console component  203  may provide analysis and resource management functions. For example, console component  203  may correlate resource alerts from multiple host components  202 . If a number of host components  202  generate similar resource alerts at approximately the same time, this may indicate that a concerted DoS attack is being performed against these computers. Console component  203  may then output information to a user indicating a possible DoS attack.  
         [0042]    In some implementations, console component  203  may reallocate resources among servers based on alerts received from host components  202 . For example, if host component  202  at server  501  issues a disk resource alert, console component  203  may instruct server  501  to begin using the disk resources of server  502 .  
       CONCLUSION  
       [0043]    The CHAINS components described above operate to ensure that servers do not crash because of issues relating to resource overload. By constantly monitoring resources of various servers and throttling back resource access when the resources of a server are over taxed, the CHAINS component helps to ensure that the server will continue to operate.  
         [0044]    Sometimes the best method for preventing attacks such as DoS and DDoS attacks is to prevent the attack from occurring in the first place. By keeping servers under DoS and DDoS attacks from failing, an attacker may give up and move on to a more susceptible target.  
         [0045]    The foregoing description of preferred embodiments of the invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention. Moreover, while a series of acts have been presented with respect to FIG. 4, the order of the acts may be different in other implementations consistent with the present invention. Moreover, non-dependent acts may be performed in parallel.  
         [0046]    Certain portions of the invention have been described as software that performs one or more functions. The software may more generally be implemented as any type of logic. This logic may include hardware, such as an application specific integrated circuit or a field programmable gate array, software, or a combination of hardware and software.  
         [0047]    No element, act, or instruction used in the description of the present application should be construed as critical or essential to the invention unless explicitly described as such. Also, as used herein, the article “a” is intended to include one or more items. Where only one item is intended, the term “one” or similar language is used.  
         [0048]    The scope of the invention is defined by the claims and their equivalents.