System, method and program product to identify a distributed denial of service attack

• US 10,225,282 B2
• Filed: 04/14/2005
• Issued: 03/05/2019
• Est. Priority Date: 04/14/2005
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Fosdick, Nicolas E.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Pan, Peiliang
• Application Number:
  US11/106,286
• Publication Number:
  US 20060236401A1
• Time in Patent Office: 5,073 Days
• Field of Search: 713 1, 713 2, 713188, 713194, 380200, 380201, 380255, 380277, 726 2, 726 11, 726 23, 726 25
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

System, method and computer program product for detecting a denial of service attack on a plurality of computers. Records are made of source IP addresses of requests sent to each of the computers. The records of requests sent to the plurality of computers are totalled per source IP address and/or per range of source IP addresses. A determination is made if the total for a source IP address and/or range of source IP addresses exceeds a respective, predetermined threshold. If so, a denial of service attack is suspected or determined, and a firewall can be notified to block subsequent requests from the source IP address and/or range of source IP addresses, and an administrator can be notified to investigate the situation. Records can also be made of requests sent to each of the computers for a file or access to an application. These records of requests sent to the plurality of computers are totalled per file or application access. A determination is made if the total for a file or application access exceeds a predetermined threshold. If so, a denial of service attack is suspected or determined, and an administrator can be notified to investigate the situation.

Claims

1. A method for detecting a denial of service attack on a plurality of destination computers, the method comprising the steps of:

a management server obtaining from the destination computers records of respective requests previously received by the destination computers from a plurality of source computers, wherein each request is a message, wherein each request comprises a source IP address of one of the source computers and a destination address of one of the destination computers, wherein the obtaining the records comprises;

periodically requesting from the destination computers logged recordings of the requests received by the destination computers from the source computers, and in response, receiving the requested logged recordings from the destination computers, and wherein the obtained records comprise the received logged recordings;

the management server determining, from an analysis of the obtained records, that the total number of requests sent over a specified period of time by one source computer of the plurality of source computers to the destination computers exceeds a specified threshold, and in response, the management server configuring a firewall to block subsequent requests sent by the one source computer from being received by the destination computers; and

the management server determining that a total number of requests sent by the one source computer for a specific file or application exceeds a specified first threshold value.

2. The method of claim 1, wherein each obtained record includes a source IP address of the source computer from which the respective request was received, and wherein the method further comprises the steps of:

the management server grouping the obtained records by source IP address into a plurality of groups of records such that the records in each group comprise a same source IP address, which results in each group being associated with a respective source computer; and

the management server determining the total number of requests sent by each source computer as being the total number of records in the group associated with the respective source computer.

3. The method of claim 1, wherein each record of the respective request comprises data including a source IP address of the respective request and a destination address of the respective request, and wherein the method further comprises the step of:

in response to the determining that the total number of requests sent by the one source computer exceeds the specified threshold, the management server notifying an administrator that the one source computer may be a source of a denial of service attack, wherein the notifying includes providing to the administrator the data in the records pertaining to the requests received from the one source computer.

4. The method of claim 3, wherein one request received from the one source computer is a SCP request or a LDAP request, and wherein the data in the record of the one request further includes (i) an identity of a requested file if the one request is the SCP request, or (ii) a type of requested information if the one request is the LDAP request.

5. The method of claim 4, wherein the one request received from the one source computer is the SCP request.

6. The method of claim 4, wherein the one request received from the one source computer is the LDAP request.

7. The method of claim 1, wherein the requests include access requests for access to an application, and wherein the method further comprises the step of:

the management server determining, from the obtained records, that a total number of the access requests exceeds a predetermined threshold, and in response, the management server notifying an administrator that the access requests may be associated with a denial of service attack, wherein the notifying includes providing to the administrator information for the application in the obtained records.

8. The method of claim 1, wherein the method further comprises the step of:

in response to the management server having determined that the total number of requests sent by the one source computer for the specific file or application exceeds the specified first threshold value by an excess number of requests, the management server determining that the excess number of requests exceeds a specified second threshold value.

9. A management system for detecting a denial of service attack on a plurality of destination computers, the management system comprising:

a CPU;

a computer readable memory;

a computer readable storage device;

first program instructions to obtain from the destination computers records of respective requests previously received by the destination computers from a plurality of source computers, wherein each request is a message, wherein each request comprises a source IP address of one of the source computers and a destination address of one of the destination computers, wherein the first program instructions to obtain the records comprises;

program instructions to periodically request from the destination computers logged recordings of the requests received by the destination computers from the source computers, and in response, to receive from the destination computers the requested logged recordings, and wherein the obtained records comprises the received logged recordings;

second program instructions to determine, from an analysis of the obtained records, that the total number of requests sent over a specified period of time by one source computer of the plurality of source computers to the destination computers exceeds a specified threshold, and in response, to configure a firewall to block subsequent requests sent by the one source computer from being received by the destination computers; and

third program instructions to determine that a total number of requests sent by the one source computer for a specific file or application exceeds a specified first threshold value, wherein the first, second and second third program instructions are stored on the computer readable storage device for execution by the CPU via the computer readable memory.

10. The system of claim 9, wherein each obtained record includes a source IP address of the source computer from which the respective request was received, and wherein the system further comprises:

fourth program instructions to group the obtained records by source IP address into a plurality of groups of records such that the records in each group comprise a same source IP address, which results in each group being associated with a respective source computer; and

fifth program instructions to determine the total number of requests sent by each source computer as being the total number of records in the group associated with the respective source computer,

wherein the fourth and fifth program instructions are stored on the computer readable storage device for execution by the CPU via the computer readable memory.

11. The system of claim 9, wherein each record of the respective request comprises data including a source IP address of the respective request and a destination address of the respective request, and wherein the system further comprises:

fourth program instructions to notify an administrator, in response to the determination that the total number of requests sent by the one source computer exceeds the specified threshold, that the one source computer may be a source of a denial of service attack, wherein the to notify includes to provide to the administrator the data in the records pertaining to the requests received from the one source computer,

wherein the fourth program instructions are stored on the computer readable storage device for execution by the CPU via the computer readable memory.

12. The system of claim 9, wherein the requests include access requests for access to an application, and wherein the system further comprises:

fourth program instructions to determine, from the obtained records, that a total number of the access requests exceeds a predetermined threshold, and in response, to notify an administrator that the access requests may be associated with a denial of service attack, wherein the to notify includes to provide to the administrator information for the application in the obtained records,

wherein the fourth program instructions are stored on the computer readable storage device for execution by the CPU via the computer readable memory.

13. A computer program product for execution in a management system to detect a denial of service attack on a plurality of destination computers, the computer program product comprising:

a computer readable storage device;

first program instructions to obtain from the destination computers records of respective requests previously received by the destination computers from a plurality of source computers, wherein each request is a message, wherein each request comprises a source IP address of one of the source computers and a destination address of one of the destination computers, wherein the first program instructions to obtain the records comprises;

program instructions to periodically request from the destination computers logged recordings of the requests received by the destination computers from the source computers, and in response, to receive from the destination computers the requested logged recordings, and wherein the obtained records comprises the received logged recordings; and

second program instructions to determine, from an analysis of the obtained records, that the total number of requests sent over a specified period of time by one source computer of the plurality of source computers to the destination computers exceeds a specified threshold, and in response, to configure a firewall to block subsequent requests sent by the one source computer from being received by the destination computers; and

third program instructions to determine that a total number of requests sent by the one source computer for a specific file or application exceeds a specified first threshold value,

wherein the first, second and third program instructions are stored on the computer readable storage device for execution by a CPU.

14. The computer program product of claim 13, wherein each obtained record includes a source IP address of the source computer from which the respective request was received, and wherein the system further comprises:

fourth program instructions to group the obtained records by source IP address into a plurality of groups of records such that the records in each group comprise a same source IP address, which results in each group being associated with a respective source computer; and

fifth program instructions to determine the total number of requests sent by each source computer as being the total number of records in the group associated with the respective source computer,

wherein the fourth and fifth program instructions are stored on the computer readable storage device for execution by the CPU.

15. The computer program product of claim 13, wherein each record of the respective request comprises data including a source IP address of the respective request and a destination address of the respective request, and wherein the system further comprises:

fourth program instructions to notify an administrator, in response to the determination that the total number of requests sent by the one source computer exceeds the specified threshold, that the one source computer may be a source of a denial of service attack, wherein the to notify includes to provide to the administrator the data in the records pertaining to the requests received from the one source computer,

wherein the fourth program instructions are stored on the computer readable storage device for execution by the CPU.

16. The computer program product of claim 15, wherein one request received from the one source computer is a SCP request or a LDAP request, and wherein the data in the record of the one request further includes (i) an identity of a requested file if the one request is the SCP request, or (ii) a type of requested information if the one request is the LDAP request.

17. The computer program product of claim 13, wherein the requests include access requests for access to an application, and wherein the system further comprises:

fourth program instructions to determine, from the obtained records, that a total number of the access requests exceeds a predetermined threshold, and in response, to notify an administrator that the access requests may be associated with a denial of service attack, wherein the to notify includes to provide to the administrator information for the application in the obtained records,

wherein the fourth program instructions are stored on the computer readable storage device for execution by the CPU via the computer readable memory.

18. A method for detecting a denial of service attack on a plurality of destination computers, the method comprising the steps of:

a management server obtaining from the destination computers records of respective requests previously received by the destination computers from a plurality of source computers, wherein each request is a message, wherein each request comprises a source IP address of one of the source computers and a destination address of one of the destination computers, wherein the obtaining the records comprises;

periodically requesting from the destination computers logged recordings of the requests received by the destination computers from the source computers, and in response, receiving the requested logged recordings from the destination computers, and wherein the obtained records comprise the received logged recordings;

the management server determining, from an analysis of the obtained records, that the total number of requests sent over a specified period of time by one source computer of the plurality of source computers to the destination computers exceeds a specified threshold, and in response, the management server configuring a firewall to block subsequent requests sent by the one source computer from being received by the destination computers; and

the management server determining that a product or service promotion caused an increased need for the requests sent by the one source computer.

19. A management system for detecting a denial of service attack on a plurality of destination computers, the management system comprising:

a CPU;

a computer readable memory;

a computer readable storage device;

first program instructions to obtain from the destination computers records of respective requests previously received by the destination computers from a plurality of source computers, wherein each request is a message, wherein each request comprises a source IP address of one of the source computers and a destination address of one of the destination computers, wherein the first program instructions to obtain the records comprises;

program instructions to periodically request from the destination computers logged recordings of the requests received by the destination computers from the source computers, and in response, to receive from the destination computers the requested logged recordings, and wherein the obtained records comprises the received logged recordings;

second program instructions to determine, from an analysis of the obtained records, that the total number of requests sent over a specified period of time by one source computer of the plurality of source computers to the destination computers exceeds a specified threshold, and in response, to configure a firewall to block subsequent requests sent by the one source computer from being received by the destination computers; and

third program instructions to determine that a product or service promotion caused an increased need for the requests sent by the one source computer,

wherein the first, second and third program instructions are stored on the computer readable storage device for execution by the CPU via the computer readable memory.

20. A computer program product for execution in a management system to detect a denial of service attack on a plurality of destination computers, the computer program product comprising:

a computer readable storage device;

first program instructions to obtain from the destination computers records of respective requests previously received by the destination computers from a plurality of source computers, wherein each request is a message, wherein each request comprises a source IP address of one of the source computers and a destination address of one of the destination computers, wherein the first program instructions to obtain the records comprises;

program instructions to periodically request from the destination computers logged recordings of the requests received by the destination computers from the source computers, and in response, to receive from the destination computers the requested logged recordings, and wherein the obtained records comprises the received logged recordings;

second program instructions to determine, from an analysis of the obtained records, that the total number of requests sent over a specified period of time by one source computer of the plurality of source computers to the destination computers exceeds a specified threshold, and in response, to configure a firewall to block subsequent requests sent by the one source computer from being received by the destination computers; and

third program instructions to determine that a product or service promotion caused an increased need for the requests sent by the one source computer,

wherein the first, second and third program instructions are stored on the computer readable storage device for execution by a CPU.