Systems and methods for HTTP-body DoS attack prevention with adaptive timeout
The present disclosure is directed generally to systems and methods for changing an application layer transaction timeout to prevent Denial of Service attacks. A device intermediary to a client and a server may receive, via a transport layer connection between the device and the client, a packet of an application layer transaction. The device may increment an attack counter for the transport layer connection by a first predetermined amount responsive to a size of the packet being less than a predetermined fraction of a maximum segment size for the transport layer connection. The device may increment the attack counter by a second predetermined amount responsive to an inter-packet-delay between the packet and a previous packet being more than a predetermined multiplier of a round trip time. The device may change a timeout for the application layer transaction responsive to comparing the attack counter to a predetermined threshold.
1. A method for incrementing or decrementing a timeout for an application layer transaction, the method comprising:
(a) decrementing or incrementing, by a device, an attack counter by a first amount based on whether a packet of an application layer transaction has a size greater than or less than a fraction of a maximum segment size of a transport layer connection for the application layer transaction;
(b) decrementing or incrementing, by the device, the attack counter by a second amount based on whether an inter-packet-delay between subsequent packets is less than or greater than a multiplier of a round trip time; and
(c) decreasing, by the device, a timeout for the application layer transaction responsive to the attack counter being more than a predetermined threshold or increasing the time for the application layer transaction responsive to the attack counter being less than the predetermined threshold.
2. The method of claim 1 , wherein (a) further comprises receiving, by the device intermediary to a client and a server, via the transport layer connection established between the device and the client, the packet of the application layer transaction.
3. The method of claim 1 , wherein (a) further comprises incrementing, by the device, the attack counter by the first amount for each packet of the application layer transaction that has the size greater than the fraction of the maximum segment size.
4. The method of claim 1 , wherein (a) further comprises decrementing, by the device, the attack counter by the first amount for each packet of the application layer transaction that has the size less than the fraction of the maximum segment size.
5. The method of claim 1 , wherein (b) further comprises incrementing, by the device, the attack counter by the second amount based for each inter-packet-delay between subsequent packets that is less than the multiplier of the round trip time.
6. The method of claim 1 , wherein (b) further comprises decrementing, by the device, the attack counter by the second amount based for each inter-packet-delay between subsequent packets that is greater than the multiplier of the round trip time.
7. The method of claim 1 , wherein (c) further comprises determining, by the device, that the attack counter is more than the predetermined threshold and responsive to this determination decreasing the timeout by a predetermined amount.
8. The method of claim 1 , wherein (c) further comprises determining, by the device, that the attack counter is less than a negative of the predetermined threshold and responsive to this determination increasing the timeout by a predetermined amount.
9. The method of claim 8 , further comprising resetting, by the device, the attack counter to zero.
10. The method of claim 1 , further comprising determining, by the device, that an elapsed time for the application layer transaction is greater than the timeout and taking a timeout action.
11. A system for incrementing or decrementing a timeout for an application layer transaction, the system comprising:
a device configured to increment or decrement an attack counter by a first amount based on whether a packet of an application layer transaction has a size greater than or less than a fraction of a maximum segment size of a transport layer connection for the application layer transaction;
wherein the device is configured to increment or decrement the attack counter by a second amount based on whether an inter-packet-delay between subsequent packets is less than or greater than a multiplier of a round trip time; and
wherein the device is configured to decrease a timeout for the application layer transaction responsive to the attack counter more than a predetermined threshold or increasing the time for the application layer transaction responsive to the attack counter being less than the predetermined threshold.
12. The system of claim 11 , wherein the device is further configured as an intermediary to a client and a server and to receive via the transport layer connection established between the device and the client, the packet of the application layer transaction.
13. The system of claim 11 , wherein the device is further configured to increment the attack counter by the first amount for each packet of the application layer transaction that has the size greater than the fraction of the maximum segment size.
14. The system of claim 11 , wherein the device is further configured to decrement the attack counter by the first amount for each packet of the application layer transaction that has the size less than the fraction of the maximum segment size.
15. The system of claim 11 , wherein the device is further configured to increment the attack counter by the second amount based for each inter-packet-delay between subsequent packets that is less than the multiplier of the round trip time.
16. The system of claim 11 , wherein the device is further configured to increment the attack counter by the second amount based for each inter-packet-delay between subsequent packets that is greater than the multiplier of the round trip time.
17. The system of claim 11 , wherein the device is further configured to determine that the attack counter is more than the predetermined threshold and responsive to this determination decreasing the timeout by a predetermined amount.
18. The system of claim 11 , wherein the device is further configured to determine that the attack counter is less than a negative of the predetermined threshold and responsive to this determination increasing the timeout by a predetermined amount.
19. The system of claim 18 , wherein the device is further configured to reset the attack counter to zero.
20. The system of claim 11 , wherein the device is further configured to determine that an elapsed time for the application layer transaction is greater than the timeout and taking a timeout action.