Distributed denial of service deterrence using outbound packet rewriting
A method for denial of service attack deterrence involves receiving requests from clients, where the requests include a server protocol component, designating a client as a malicious client based on the requests, intercepting and inspecting, prior to the clients receiving a response, the server protocol component of each response to the clients, and rewriting at least a portion of the server protocol component of each response destined for the malicious client.
1. A method for denial of service attack deterrence, comprising:
identifying, using a hardware processor, a plurality of requests sent to a server from a plurality of clients;
designating, using the hardware processor, one of the plurality of clients as a malicious client based on the plurality of requests;
intercepting, using the hardware processor, a response issued by the server and in transit to the malicious client, wherein the response corresponds to at least one of the plurality of requests;
adding, using the hardware processor and in response to intercepting the response, an error to the response by replacing an existing value in the response with a erroneous value; and
forwarding, using the hardware processor, the response having the erroneous value to the malicious client.
2. The method of claim 1 , further comprising:
interrupting a TCP/IP handshake between the malicious client and the server,
wherein the existing value corresponds to a closed status of a connection between the server and the malicious client, and
wherein the erroneous value corresponds to an open status of the connection.
3. The method of claim 1 , wherein the existing value is an internet protocol (IP) address of a website, and wherein the erroneous value is a fictitious IP address.
4. The method of claim 1 , wherein the existing value is an internet protocol (IP) address of a website, and wherein the erroneous value is an IP address of the malicious client.
5. The method of claim 1 , wherein the existing value is an actual status of the server, and wherein the erroneous value is a fictitious status of the server.
6. The method of claim 1 , wherein the hardware processor is located on an intrusion detection system (IDS), and wherein the IDS is separate from the server.
7. The method of claim 1 , wherein the server is a domain name server (DNS).
8. A system for denial of service attack deterrence, comprising:
a hardware processor; and
a memory operatively connected to the hardware processor and storing software instructions comprising functionality to:
identify a plurality of requests sent to a server from a plurality of clients;
designate at least one of the plurality clients as a malicious client based on the plurality of requests;
intercept a response issued by the server and in transit to the malicious client, wherein the response corresponds to at least one of the plurality of requests;
add, in response to intercepting the response, an error to the response by replacing an existing value in the response with a erroneous value; and
forward the response having the erroneous value to the malicious client.
9. The system of claim 8 , wherein the existing value is an internet protocol (IP) address of a website, and wherein the erroneous value is a fictitious IP address.
10. The system of claim 8 , wherein the existing value is an internet protocol (IP) address of a website, and wherein the erroneous value is an IP address of the malicious client.
11. The system of claim 8 , wherein the existing value is an actual status of the server, and wherein the erroneous value is a fictitious status of the server.
12. The system of claim 8 , wherein the server is a domain name server (DNS).
13. The system of claim 8 , further comprising:
a load balancer balancing the plurality of requests received by the server.
14. A non-transitory computer readable medium storing instructions for denial of service attack deterrence, the instructions with functionality to:
identify a plurality of requests sent to a server from a plurality of clients;
designate one of the plurality of clients as a malicious client based on the plurality of requests;
intercept a response issued by the server and in transit to the malicious client, wherein the response corresponds to at least one of the plurality of requests;
add, in response to intercepting the response, an error to the response by replacing an existing value in the response with a erroneous value; and
forward the response having the erroneous value to the malicious client.
15. The non-transitory computer readable medium of claim 14 , further comprising instructions with functionality to:
interrupt a TCP/IP handshake between the malicious client and the server,
wherein the existing value corresponds to a closed status of a connection between the server and the malicious client, and
wherein the erroneous value corresponds to an open status of the connection.
16. The non-transitory computer readable medium of claim 14 , wherein the existing value is an internet protocol (IP) address of a website, and wherein the erroneous value is a fictitious IP address.
17. The non-transitory computer readable medium of claim 14 , wherein the existing value is an internet protocol (IP) address of a website, and wherein the erroneous value is an IP address of the malicious client.
18. The non-transitory computer readable medium of claim 14 , wherein the existing value is an actual status of the server, and wherein the erroneous value is a fictitious status of the server.
19. The non-transitory computer readable medium of claim 14 , wherein the server is a domain name server (DNS).