Malicious attacks, such as Denial-of-service (DoS) attacks, attempt to make computer resources unavailable to their intended users. For example, a DoS attack against a web server often causes the hosted web pages to be unavailable. DoS attacks can cause significant service disruptions when limited resources need to be allocated to the attackers instead of to legitimate users. The attacking machines typically inflict damage by sending a large number of Internet Protocol (IP) packets across the Internet, directed to the target victim of the attack. For example, a DoS attack can comprise attempts to “flood” a network, thereby preventing legitimate network traffic, or to disrupt a server by sending more requests than the server can handle, thereby preventing access to one or more services.
A number of techniques have been proposed or suggested for defending against such malicious attacks. For example, U.S. patent application Ser. No. 11/197,842, entitled “Method and Apparatus for Defending Against Denial of Service Attacks in IP Networks by Target Victim Self-Identification and Control,” and U.S. patent application Ser. No. 11/197,841, entitled “Method and Apparatus for Defending Against Denial of Service Attacks in IP Networks Based on Specified Source/Destination IP Address Pairs,” disclose techniques for detecting and denouncing DoS attacks.
Systems that defend against such malicious attacks typically employ a detector associated with the customer network and a central filter in the network of the service provider to protect the customer network against malicious attacks. Generally, the detector will detect a malicious attack against the customer network and will send one or more denunciation or notification messages to the central filter. A malicious attack is typically detected by inspecting the packets received at the target victim for one or more predefined strings. The predefined strings, however, can often match legitimate attempts to access the target victim. Thus, the detector must inspect potentially many accesses and responses while keeping information about the source endpoint doing the access. In addition, such packet inspection techniques do not work over an encrypted link and can often be fooled by adding additional elements in the path to be accessed.
A need therefore exists for improved methods and apparatus for detecting unwanted traffic in one or more packet networks utilizing string analysis.