基于数据包检查的Slow HTTP POST攻击检测方法  

Detection method for Slow HTTP POST attack based on packet size check

作　　者：邓诗琪 武旭东 牛小龙 李小卫 雷敏 Deng Shiqi;Wu Xudong;Niu Xiaolong;Li Xiaowei;Lei Min(School of Cyberspace Security,Beijing University of Posts and Telecommunications,Beijing 100876;National Engineering Laboratory for Disaster Recovery Technology,Beijing 100876;Sichuan Kerui Software Co.,Ltd.,Sichuan Mianyang 621000)

机构地区：[1]北京邮电大学网络空间安全学院,北京100876 [2]灾备技术国家工程实验室,北京100876 [3]四川科瑞软件有限责任公司,四川绵阳621000

出　　处：《网络空间安全》2018年第2期60-63,共4页Cyberspace Security

基　　金：2015年度国家科技支撑计划项目(项目编号:2015BAH08F02)

摘　　要：Slow HTTP POST攻击属于应用层慢速HTTP拒绝服务攻击。在Slow HTTP POST攻击中,攻击者使用正常的POST请求进行数据的传输,但是其报文首部中的Content-Length参数值被设置为很大的值。然而,为了长时间占用建立起的请求连接,攻击者在请求首部得到确认之后开始进行的传输主体中,设置了极小的数据传输大小,导致Web服务器认为请求数据没有传输完毕,将长时间保留该请求连接,当服务器的连接资源池被类似的攻击请求占满,就会造成拒绝服务。文章根据正常HTTP POST请求发生后,数据以"尽力传输"的模式进行传输的特性与Slow HTTP POST攻击下数据传输的特性的区别,提出基于数据包大小检查的Slow HTTP POST攻击检测方法,并对检测方法进行了仿真实验加以验证。Slow HTTP POST Attack is a type of slow-rate HTTP denial of service attack on application layer.An attacker uses normal POST request to make data transmission,but sets a large value for Content-Length parameter in header.However,for the purpose of keeping a long-time connection,the attacker makes a small data-transmission value in transmission body after the header is acknowledged and the Web server will still hold the connection and wait for other data to be transmitted.When connection resource pool of the Web server has been completely filled,the Web Server begins to deny service.This paper proposes a detection method for slow HTTP POST attack based on packet size check according to differences between normal data transmission schedule called“Best-Effort”and attack data transmission,and makes simulation test to verify the detection method.

关 键 词：数据包检查 SlowHTTPPOST攻击 检测方法 

分 类 号：TP393.083[自动化与计算机技术—计算机应用技术]