Coordinated detection and differentiation of denial of service attacks

1. A method in an analyzer module to detect and distinguish between a plurality of types of Denial-of-Service (DoS) attacks, wherein the analyzer module is within a same protected network and on-premise with a web application server executing on server hardware, wherein the web application server is to receive Hypertext Transfer Protocol (HTTP) request messages transmitted from devices that are off-premise and outside of the protected network and respond by transmitting HTTP response messages back to those devices, wherein the analyzer module is coupled to receive these HTTP request messages and HTTP response messages, the method comprising:

tracking, in the analyzer module, whether test HTTP messages are timely received by the analyzer module, wherein the test HTTP messages comprise test HTTP request messages that a signal generation module is configured to transmit to the web application server according to a schedule and test HTTP response messages that the web application server is expected to transmit to the signal generation module in response to the test HTTP request messages, wherein the signal generation module is configured to transmit the test HTTP request messages for the purpose of allowing the analyzer module to detect and distinguish between the plurality of types of DoS attacks, wherein the signal generation module is executing on a device that is off-premise and outside the protected network, wherein the analyzer module is aware of a timeliness with which the signal generation module is expected to transmit the test HTTP request messages to the web application server and with which the web application server is expected to transmit the test HTTP response messages to the signal generation module in response to the test HTTP request messages; and

detecting the occurrence of a DoS attack and identifying the type of the DoS attack based upon the result of the tracking indicating that a number of the test HTTP messages have not been timely received by the analyzer module.

2. The method of claim 1 , wherein the plurality of DoS attack types that the analyzer module is able to differentiate between includes:

layer 7 application layer attacks against the web application server; and

infrastructure attacks that affect a communication path to the web application server.

3. The method of claim 2 , wherein the infrastructure attacks that affect the communication path to the web application server that the analyzer module is able to differentiate between include:

volumetric attacks against one or more communication components along the communication path to the web application server;

Domain Name Server (DNS) redirection attacks against one or more DNS servers; and

DNS takedown attacks against the one or more DNS servers.

4. The method of claim 1 , wherein said identifying the type of the DoS attack comprises:

determining the type of the DoS attack is an infrastructure attack when a number of the test HTTP request messages have not been timely received by the analyzer module; and

determining the type of the DoS attack is an application layer attack against the web application server when a number of the test HTTP response messages have not been timely received by the analyzer module.

5. The method of claim 4 , wherein the test HTTP request messages further include:

a first plurality of messages to be transmitted by the signal generation module using a configured Internet Protocol (IP) address of the web application server;

a second plurality of messages to be transmitted by the signal generation module, wherein each of the second plurality of messages is only to be transmitted after a successful resolution, for that message, of an IP address of the web application server via a DNS query; and

wherein said identifying the type of the DoS attack further comprises, determining the type of the DoS attack is a DNS attack when,

the number of the first plurality of messages have been timely received by the analyzer module, and

a number of the second plurality of messages have not been timely received by the analyzer module.

6. The method of claim 5 , wherein:

the test HTTP request messages further include a third plurality of messages to be transmitted by the signal generation module, wherein each of the third plurality of messages is to be transmitted using the most recent resolved IP address attained by the DNS queries; and

wherein said identifying the type of the DoS attack further comprises,

determining the type of the DoS attack is a DNS redirection attack when,

the number of the first plurality of messages have been timely received by the analyzer module,

a number of the second plurality of messages have not been timely received by the analyzer module, and

a number of the third plurality of messages have not been timely received by the analyzer module; and

determining the type of the DoS attack is a Domain Name Server (DNS) takedown attack when,

the number of the first plurality of messages have been timely received by the analyzer module,

the number of the second plurality of messages have not been timely received by the analyzer module, and

the number of the third plurality of messages have been timely received by the analyzer module.

7. The method of claim 1 , further comprising:

detecting that the DoS attack has ended or that an effect of the DoS attack has been mitigated based upon determining that a threshold number of recently received test HTTP messages have been timely received by the analyzer module.

8. The method of claim 1 , wherein each of the test HTTP request messages include authentication data to allow the analyzer module to verify that the test HTTP request messages were originated by the signal generation module.

9. The method of claim 1 , wherein the schedule indicates that at least some of the test HTTP request messages are transmitted at irregular intervals.

10. The method of claim 1 , further comprising:

responsive to said detecting the occurrence of the DoS attack and identifying the type of the DoS attack, generating an alert indicating the identified type of the DoS attack.

11. A computing device to detect and distinguish between a plurality of types of Denial-of-Service (DoS) attacks, wherein the computing device is to be within a same protected network and on-premise with a web application server, wherein the web application server is to receive Hypertext Transfer Protocol (HTTP) request messages transmitted from devices that are off-premise and outside of the protected network and respond by transmitting HTTP response messages back to those devices, wherein the computing device is to be coupled to receive these HTTP request messages and HTTP response messages, the computing device comprising:

a set of one or more network interfaces to receive test HTTP messages, wherein the test HTTP messages comprise test HTTP request messages that a signal generation module is configured to transmit to the web application server according to a schedule and test HTTP response messages that the web application server is expected to transmit to the signal generation module in response to the test HTTP request messages, wherein the test HTTP request messages and the test HTTP response messages are for the purpose of allowing the computing device to detect and distinguish between the plurality of types of DoS attacks, wherein the signal generation module is executing on a device that is off-premise and outside the protected network; and

an analyzer module communicatively coupled with the set of network interfaces to,

track whether test HTTP messages are timely received by the computing device, wherein the analyzer module is aware of a timeliness with which the signal generation module is expected to transmit the test HTTP request messages to the web application server and with which the web application server is expected to transmit the test HTTP response messages to the signal generation module in response to the test HTTP request messages, and

detect occurrences of DoS attacks and identify the types of the DoS attacks based upon the results of the tracking indicating that numbers of the test HTTP messages have not been timely received by the computing device.

12. The computing device of claim 11 , wherein the plurality of DoS attack types that the analyzer module is able to differentiate between includes:

layer 7 application layer attacks against the web application server; and

infrastructure attacks that affect a communication path to the web application server.

13. The computing device of claim 12 , wherein the infrastructure attacks that affect the communication path to the web application server that the analyzer module is able to differentiate between include:

volumetric attacks against one or more communication components along the communication path to the web application server;

Domain Name Server (DNS) redirection attacks against one or more DNS servers; and

DNS takedown attacks against the one or more DNS servers.

14. The computing device of claim 11 , wherein the analyzer module, to identify the types of the DoS attacks, is to:

determine that a type of a DoS attack is an infrastructure attack when a number of the test HTTP request messages have not been timely received by the analyzer module; and

determine that the type of the DoS attack is an application layer attack against the web application server when a number of the test HTTP response messages have not been timely received by the analyzer module.

15. The computing device of claim 14 , wherein the test HTTP request messages further include:

a first plurality of messages to be transmitted by the signal generation module using a configured Internet Protocol (IP) address of the web application server;

a second plurality of messages to be transmitted by the signal generation module, wherein each of the second plurality of messages is only to be transmitted after a successful resolution, for that message, of an IP address of the web application server via a DNS query; and

wherein the analyzer module, to identify the types of the DoS attacks, is further to determine that the type of the DoS attack is a DNS attack when,

the number of the first plurality of messages have been timely received by the analyzer module, and

a number of the second plurality of messages have not been timely received by the analyzer module.

16. The computing device of claim 15 , wherein:

the test HTTP request messages are to further include a third plurality of messages to be transmitted by the signal generation module, wherein each of the third plurality of messages is to be transmitted using the most recent resolved IP address attained by the DNS queries; and

wherein the analyzer module, to identify the types of the DoS attacks, is further to

determine that the type of the DoS attack is a DNS redirection attack when,

the number of the first plurality of messages have been timely received by the analyzer module,

a number of the second plurality of messages have not been timely received by the analyzer module, and

a number of the third plurality of messages have not been timely received by the analyzer module; and

determine that the type of the DoS attack is a Domain Name Server (DNS) takedown attack when,

the number of the first plurality of messages have been timely received by the analyzer module,

the number of the second plurality of messages have not been timely received by the analyzer module, and

the number of the third plurality of messages have been timely received by the analyzer module.

17. The computing device of claim 11 , wherein the analyzer module is further to:

detect that the DoS attack has ended or that an effect of the DoS attack has been mitigated based upon determining that a threshold number of recently received test HTTP messages have been timely received by the analyzer module.

18. The computing device of claim 11 , wherein each of the test HTTP request messages is to include authentication data to allow the analyzer module to verify that the test HTTP request messages were originated by the signal generation module.

19. The computing device of claim 11 , wherein the schedule indicates that at least some of the test HTTP request messages are to be transmitted at irregular intervals.

20. The computing device of claim 11 , wherein the analyzer module is further to:

generate, responsive to said detecting the occurrences of the DoS attacks and identifying the types of the DoS attacks, alerts indicating the identified types of the DoS attacks.

21. A non-transitory computer-readable storage medium storing instructions that can be executed by a processor of a computing device to implement an analyzer module to detect and distinguish between a plurality of types of Denial-of-Service (DoS) attacks, wherein the analyzer module is within a same protected network and on-premise with a web application server, wherein the web application server is to receive Hypertext Transfer Protocol (HTTP) request messages transmitted from devices that are off-premise and outside of the protected network and respond by transmitting HTTP response messages back to those devices, wherein the analyzer module is coupled to receive these HTTP request messages and HTTP response messages, and wherein the instructions, when executed by the processor, cause the analyzer module to perform operations comprising:

tracking, in the analyzer module, whether test HTTP messages are timely received by the analyzer module, wherein the test HTTP messages comprise test HTTP request messages that a signal generation module is configured to transmit to the web application server according to a schedule and test HTTP response messages that the web application server is expected to transmit to the signal generation module in response to the test HTTP request messages, wherein the signal generation module is configured to transmit the test HTTP request messages for the purpose of allowing the analyzer module to detect and distinguish between the plurality of types of DoS attacks, wherein the signal generation module is executing on a device that is off-premise and outside the protected network, wherein the analyzer module is aware of a timeliness with which the signal generation module is expected to transmit the test HTTP request messages to the web application server and with which the web application server is expected to transmit the test HTTP response messages to the signal generation module in response to the test HTTP request messages; and

detecting the occurrence of a DoS attack and identifying the type of the DoS attack based upon the result of the tracking indicating that a number of the test HTTP messages have not been timely received by the analyzer module.

22. The non-transitory computer-readable storage medium of claim 21 , wherein the plurality of DoS attack types that the analyzer module is able to differentiate between includes:

layer 7 application layer attacks against the web application server; and

infrastructure attacks that affect a communication path to the web application server.

23. The non-transitory computer-readable storage medium of claim 22 , wherein the infrastructure attacks that affect the communication path to the web application server that the analyzer module is able to differentiate between includes:

volumetric attacks against one or more communication components along the communication path to the web application server;

Domain Name Server (DNS) redirection attacks against one or more DNS servers; and

DNS takedown attacks against the one or more DNS servers.

24. The non-transitory computer-readable storage medium of claim 21 , wherein said identifying the type of the DoS attack comprises:

determining the type of the DoS attack is an infrastructure attack when a number of the test HTTP request messages have not been timely received by the analyzer module; and

determining the type of the DoS attack is an application layer attack against the web application server when a number of the test HTTP response messages have not been timely received by the analyzer module.

25. The non-transitory computer-readable storage medium of claim 24 , wherein the test HTTP request messages further include:

a first plurality of messages to be transmitted by the signal generation module using a configured Internet Protocol (IP) address of the web application server;

a second plurality of messages to be transmitted by the signal generation module, wherein each of the second plurality of messages is only to be transmitted after a successful resolution, for that message, of an IP address of the web application server via a DNS query; and

wherein said identifying the type of the DoS attack further comprises,

determining the type of the DoS attack is a DNS attack when,

the number of the first plurality of messages have been timely received by the analyzer module, and

a number of the second plurality of messages have not been timely received by the analyzer module.

26. The non-transitory computer-readable storage medium of claim 25 , wherein:

the test HTTP request messages further include a third plurality of messages to be transmitted by the signal generation module, wherein each of the third plurality of messages is to be transmitted using the most recent resolved IP address attained by the DNS queries; and

wherein said identifying the type of the DoS attack further comprises,

determining the type of the DoS attack is a DNS redirection attack when,

the number of the first plurality of messages have been timely received by the analyzer module,

a number of the second plurality of messages have not been timely received by the analyzer module, and

a number of the third plurality of messages have not been timely received by the analyzer module; and

determining the type of the DoS attack is a Domain Name Server (DNS) takedown attack when,

the number of the first plurality of messages have been timely received by the analyzer module,

the number of the second plurality of messages have not been timely received by the analyzer module, and

the number of the third plurality of messages have been timely received by the analyzer module.

27. The non-transitory computer-readable storage medium of claim 21 , wherein the operations further comprise:

detecting that the DoS attack has ended or that an effect of the DoS attack has been mitigated based upon determining that a threshold number of recently received test HTTP messages have been timely received by the analyzer module.

28. The non-transitory computer-readable storage medium of claim 21 , wherein each of the test HTTP request messages includes authentication data to allow the analyzer module to verify that the test HTTP request messages were originated by the signal generation module.

29. The non-transitory computer-readable storage medium of claim 21 , wherein the schedule indicates that at least some of the test HTTP request messages are transmitted at irregular intervals.

30. The non-transitory computer-readable storage medium of claim 21 , wherein the operations further comprise:

responsive to said detecting the occurrence of the DoS attack and identifying the type of the DoS attack, generating an alert indicating the identified type of the DoS attack.