Systems and methods for preventing denial of service attacks utilizing a proxy server
Aspects of the present disclosure involve systems, methods, computer program products, and the like, for utilizing an access log of a proxy server device of a content delivery network (CDN) to detect and mitigate a denial of service (DOS) on a web or content server hosted by the CDN. Through an analysis of the content requests received at the proxy server listed in the access logs, one or more IP addresses may be identified as involved in a potential DOS attack or other suspicious behavior. Once identified, the suspicious activities of the one or more IP addresses may be tracked and aggregated over a particular period of time, with each detected suspicious request to the content server being counted. The count of suspicious requests to the content server may then be compared to one or more threshold values and a remediation action may occur when the thresholds are met or exceeded.
1. A method for managing a content delivery network (CDN), the method comprising:
obtaining an access log of a proxy server in communication with an associated content server of the CDN, the access log comprising uniform resource locator (URL) requests for content intended for the associated content server, wherein each URL request for content comprises a request type indicating a type of content requested from the associated content server;
scanning the access log to detect a plurality of entries in the access log indicating the proxy server receiving a first URL request of a group of related URL requests from a particular Internet Protocol (IP) address associated with a requesting device, the receiving of the first URL request of the group of related URL requests from the particular IP address occurring within a first timeframe;
comparing the plurality of entries in the access log indicating the proxy server receiving the first URL request of the group of related URL requests from the particular IP address associated with a requesting device to a first threshold value;
storing the particular IP address in a listing of potential sources of denial of service (DOS) attacks on the associated content server when the plurality of entries in the access log indicating the proxy server receiving the first URL request of the group of related URL requests from the particular IP address associated with a requesting device is greater than the first threshold value; and
adjusting the first threshold value based on at least the URL request type included in the URL request for content received at the proxy server.
2. The method of claim 1 further comprising:
executing a remedial instruction in response to the storing of the particular IP address in the listing of potential sources of DOS attacks.
3. The method of claim 2 wherein the remedial instruction comprises transmitting a report to an administrator device associated with an administrator of the proxy server, the report comprising a listing of particular IP address associated with a requesting device.
4. The method of claim 2 further comprising:
comparing the plurality of entries in the access log indicating the proxy server receiving the first URL request of the group of related URL requests from the particular IP address associated with a requesting device to a second threshold value, the second threshold value greater than the first threshold value.
5. The method of claim 4 wherein the remedial instruction comprises utilizing the proxy server to block access to the content of the associated content server by the particular IP address for a remedial period of time when the plurality of entries in the access log indicating the proxy server receiving the first URL request of the group of related URL requests from the particular IP address associated with a requesting device is greater than the second threshold value.
6. The method of claim 5 further comprising:
comparing the particular IP address to a database of known IP addresses of previously received DOS attacks to determine if the IP address is included in the database of known IP addresses.
7. The method of claim 6 further comprising:
analyzing the first URL request of the group of related URL requests from the particular IP address associated with a requesting device to determine a pattern of DOS attack requests from the IP address; and
storing the pattern of DOS attack requests from the IP address in the database of known IP addresses of previously received DOS attacks.
8. The method of claim 1 further comprising:
aggregating the plurality of entries in the access log indicating proxy server receiving the first URL request of a group of related URL requests from the particular IP address occurring within a second timeframe.
9. A content delivery network (CDN) comprising:
a content server through which content is available to a plurality of requesting devices; and
a proxy server in communication between the content server and the plurality of requesting devices, the proxy server configured to:
obtain an access log comprising uniform resource locator (URL) requests for content intended for the associated content server, wherein each URL request for content comprises a request type indicating a type of content requested from the associated content server;
detect a plurality of entries in the access log indicating the proxy server receiving a first URL request of a group of related URL requests from a particular Internet Protocol (IP) address associated with a requesting device of the plurality of requesting devices within a first timeframe;
compare the plurality of entries in the access log indicating the proxy server receiving the first URL request of the group of related URL requests from the particular IP address associated with a requesting device to a first threshold value;
store the particular IP address in a listing of potential sources of denial of service (DOS) attacks on the associated content server when the plurality of entries in the access log indicating the proxy server receiving the first URL request of the group of related URL requests from the particular IP address associated with a requesting device is greater than the first threshold value; and
adjust the first threshold value based on at least the URL request type included in the URL request for content received at the proxy server.
10. The content delivery network of claim 9 wherein the proxy server further executes a remedial instruction in response to the storing of the particular IP address in the listing of potential sources of DOS attacks.
11. The content delivery network of claim 10 wherein the remedial instruction comprises transmitting a report to an administrator device associated with an administrator of the proxy server, the report comprising a listing of particular IP address associated with a requesting device.
12. The content delivery network of claim 10 wherein the proxy server further compares the plurality of entries in the access log indicating the proxy server receiving the first URL request of the group of related URL requests from the particular IP address associated with a requesting device to a second threshold value, the second threshold value greater than the first threshold value.
13. The content delivery network of claim 12 wherein the remedial instruction comprises blocking access to the content of the associated content server by the particular IP address for a remedial period of time when the plurality of entries in the access log indicating the proxy server receiving the first URL request of the group of related URL requests from the particular IP address associated with a requesting device is greater than the second threshold value.
14. The content delivery network of claim 13 wherein the proxy server further compares the particular IP address to a database of known IP addresses of previously received DOS attacks to determine if the IP address is included in the database of known IP addresses.
15. The content delivery network of claim 14 wherein the proxy server analyzes the first URL request of the group of related URL requests from the particular IP address associated with a requesting device to determine a pattern of DOS attack requests from the IP address and stores the pattern of DOS attack requests from the IP address in the database of known IP addresses of previously received DOS attacks.
16. The content delivery network of claim 9 wherein the proxy server further aggregates the plurality of entries in the access log indicating the associated content server receiving the first URL request of a group of related URL requests from the particular IP address occurring within a second timeframe.