Method and System for Managing Denial of Service Situations

• US 20080040801A1
• Filed: 11/29/2004
• Published: 02/14/2008
• Est. Priority Date: 11/29/2004
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Caffaratti, Fabrizio, Ferreri, Fabia, De Lutiis, Paolo, Buriano, Luca
• Granted Patent: US 8,356,350 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

For managing denial of service situations at an application level in a communications network receiving message data, the message data are monitored in a sensor that sends an event message when detecting an alarm condition; a control logic detects a first analysis to be performed associated with the received event message and generates a request; an analysis module receives the request of analysis, performs the analysis and sends a result message; the control logic receives the result message and detects an action to be taken associated with the result message, the action being a countermeasure or a further analysis. For determining the analysis to be performed and the action to be taken, the control logic browses rules stored in a memory, each rule including a conditional clause and an associated action to be taken.

Claims

1-27. -27. (canceled)

28. A method for managing denial of service situations at an application level in a communications network receiving message data, comprising:

monitoring said message data;

generating at least one event message;

determining a first analysis to be performed associated with said event message;

generating a request of said first analysis;

receiving said request of first analysis, performing said first analysis and sending a first result message;

receiving said first result message and determining an action to be taken associated with said first result message; and

generating a countermeasure message according to a countermeasure to be taken.

29. The method of claim 28, wherein:

said determining a first analysis comprises performing a first browsing of rules, each rule comprising a conditional clause and an associated action to be taken, and determining a first rule comprising said event message as a conditional clause and said first analysis as the action to be taken; and

said determining an action to be taken associated with said first result message comprises performing a second browsing of rules and determining a second rule comprising said first result message as a conditional clause.

30. The method of claim 29, wherein said second rule specifies a further analysis as the action to be taken, the method further comprising, before said generating a countermeasure message:

generating a request of said further analysis;

receiving said request of said further analysis, performing said further analysis and sending a second result message;

receiving said second result message;

third browsing said rule memory; and

determining a third rule comprising said second result message as a conditional clause.

31. The method of claim 30, wherein, in case said third rule specifies a further analysis as an action to be taken, repeating said steps of generating and receiving a request of further analysis;

performing said further analysis;

sending and receiving said second result message;

performing a third browsing; and

determining a third rule, as long as said third rule specifies another analysis as an action to be taken, and generating said countermeasure message when said third rule specifies said countermeasure as an action to be taken.

32. The method of claim 31, wherein said first, second and third analyses are performed by respective analysis modules.

33. The system of claim 31, wherein said first, second and third browsing are performed by a same control logic unit.

34. The method of claim 29, wherein said performing said first analysis comprises clustering of sources of said message data.

35. The method of claim 34, wherein said clustering of sources comprises retrieving information regarding said event;

retrieving information regarding sources of said message data; and

generating a list based on said sources, wherein said generating a first result message comprises attaching said list.

36. The method of claim 35, wherein said generating a list comprises counting message data received from each source and listing overrepresented sources whose counting exceeds a threshold.

37. The method of claim 30, wherein said performing said further analysis comprises detecting internal and external sources.

38. The method of claim 37, wherein said detecting internal and external sources comprises checking whether said source matches a stored address and, in case of matching, generating an internal address list comprising said stored address.

39. The method of claim 28, wherein said generating a countermeasure message comprises sending an alarm message comprising data related to said event and result messages.

40. The method of claim 28, wherein said communications network is a simple mail transfer protocol, a hypertext transfer protocol, a session initiation protocol, a common object request broker architecture or a web services network.

41. A system for managing denial of service situations at an application level in a communications network receiving message data, comprising:

at least one event sensor configured to monitor said message data and to generate at least one event message;

a control logic configured to receive said event message and to detect denial of service situations;

a plurality of analysis modules connected to said control logic and each configured to execute at least one analysis and to generate a result message;

said control logic being configured to determine a first analysis to be performed associated with said event message, to generate a request of said first analysis for at least one of said plurality of analysis modules, to receive said result message from said requested analysis module, to determine an action to be taken associated with said result message, and to generate a countermeasure message according to a countermeasure to be taken.

42. The system of claim 41, comprising a rule memory structure connected to said control logic and storing a plurality of rules, each rule comprising at least one conditional clause and an associated action to be taken;

said control logic being configured to browse said rule memory structure when receiving said event messages, to detect a first rule comprising said event message as a conditional clause and said first analysis as the action to be taken, and to browse said rule memory structure to detect a second rule comprising said result message as a conditional clause and a further analysis or a countermeasure as the associated action to be taken.

43. The system of claim 42, wherein each of said analysis modules is configured to perform its own analysis.

44. The system of claim 42, further comprising a connection network connected to said event sensor, said control logic and said analysis modules and configured to transmit said message data, said event message, said request, said result message and said countermeasure message.

45. The system of claim 41, comprising a countermeasure module connected to said connection network, said countermeasure module being configured to receive said countermeasure message from said control logic and to perform a countermeasure.

46. The system of claim 45, wherein said countermeasure module is configured to generate a message chosen between an alarm message sent to a system'"'"'s human security administrator and an automatic feed-back message comprising configuration information for clients of said system.

47. The system of any of claim 41, further comprising a flow analyzer module connected between an outside network and said event sensor and configured to receive said message data and to transmit at least some of said message data to said event sensor.

48. The system of claim 47, wherein said flow analyzer module is configured to check said data messages and to transmit to said event sensor only data messages comprising a preset connection request.

49. The system of claim 42, wherein said event sensor is a frequency sensor.

50. The system of claim 48, wherein said frequency sensor comprises a rate monitoring module configured to monitor a rate of arrival of communication requests within a presettable time.

51. The system of claim 50, wherein said rate monitoring module comprises a counter configured to generate a counting output and comparator configured to generate a trigger output when said counting output exceeds a threshold within said presettable time.

52. The system of claim 51, wherein said threshold is calculated as a percentile of incoming requests in said presettable time.

53. The system of claim 41, wherein said communications network is a simple mail transfer protocol, a hypertext transfer protocol, a session initiation protocol, a common object request broker architecture or a web services network.

54. The system of claim 41, comprising a plurality of clients having own source addresses, wherein said analysis modules comprise a source clustering analysis module and an intranet check analysis module, said source clustering analysis module being configured to count the number of distinct data message source addresses, to compare said number of distinct data message source addresses to a preset dimension threshold and to generate a list of source addresses exceeding said preset dimension threshold;

and said intranet check analysis module being configured to compare said source addresses exceeding said predefined dimension threshold with said own source addresses and to generate a list of said own source addresses that exceed said preset dimension threshold.