AT11: Excessive VERB
Definition
An attacker generates a large number of valid HTTP requests to a victim web server. The HTTP request is generally a GET request of a common web page or image, often a large one. Each bot can generate a large number of valid requests so the attacker can use a relatively small number of bot to achieve a successful attack.
VERB Attacks are non-spoofed: the source IP is the actual public IP of the attacker bot and the source IP range is equal to the number of bots used in the attack. The most common form of VERB attack uses GET requests but the attacker can also use POST or other HTTP actions to cause the same impact on the victim. An Excessive VERB Attack typically does not generate significant bandwidth increase on the network but can render the victim unresponsive by consuming server resources.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Non-Spoofed | Yes | Small | High | -- | Valid | -- | High | Short | High |
Defense Fundamentals
The RioRey algorithm detects Excessive VERB attacks by developing a set of signatures on HTTP requests for each Source/Destination IP pair for each zone. The algorithm then identifies how often the same or similar request is issued over a time period.
| Description | Filter Sensitivity LEVEL | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 OFF | 1 | 2 | 3 | 4 | 5* | 6 | 7 | 8 | 9 | 10 | |
| Duplicate Packet Threshold (ppm) | NA | 1,000 | 350 | 75 | 50 | 30* | 13 | 11 | 10 | 9 | 8 |
| Victim Attack Packet Threshold (ppm) | NA | 2,000 | 1,000 | 100 | 75 | 70* | 30 | 25 | 20 | 18 | 10 |
| Victim Attack Ratio (bad/total) | NA | 99 | 95 | 92 | 90 | 85* | 85 | 85 | 80 | 75 | 50 |
| Attacker Attack Packet Threshold (ppm) | NA | 2,000 | 1,000 | 100 | 75 | 30* | 13 | 11 | 12 | 9 | 8 |
| Attack Attack Ratio (bad/total) | NA | 99 | 95 | 92 | 90 | 85* | 85 | 85 | 80 | 75 | 50 |
| Attacker IP block time (minutes) | NA | 5 | 15 | 30 | 45 | 60* | 120 | 240 | 480 | 960 | 1440 |
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
You can hit Clear Filter List to remove all IPs from the filter list for this attack type. This is equivalent to running a Clear for all IPs under this attack type in Clear Filter List.
If you are changing filter settings, it is recommended you Clear Filter List after you have updated your settings to prevent addresses from getting blocked again before the new settings take effect.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Filter sensitivity | Level 5 (1-10) | This feature allows the user to adjust the sensitivity level of the filter for Excessive VERB attacks. The recommended default setting is level 5. To reduce the filter sensitivity, lower the setting number. The higher the setting, the more sensitive the filter becomes. Due to the aggressiveness of the setting, Level 10 is liable to drop some good traffic. Alter the sensitivity settings gradually as needed. |
| Show Advanced Controls | Disabled | Enabling this control opens up all of the controls for AT11. By default, the controls below will populate at their settings for the currently set filter sensitivity level as shown in thetable above. The advanced controls require careful configuration in order to work correctly. They should generally be adjusted after direct consultation with RioRey. |
| Duplicate Packet Threshold (ppm) | NA | |
| Victim Attack Packet Threshold (ppm) | NA | |
| Victim Attack Ratio (bad/total) | NA | |
| Attacker Attack Packet Threshold (ppm) | NA | |
| Attacker Attack Ratio (bad/total) | NA | |
| Max Request Size to Check | NA | |
| Attacker IP block time (minutes) | NA |
Attacker and Victim Identification
In HTTP Excessive Verb attacks and all other layer 7 HTTP attacks, we can identify a single source IP sending attacking packets to the destination victim IP, a degree of certainty that is rare for other types of DDoS attack. In contrast, for example, in spoofed source IP UDP attacks one can often establish only a "confidence level" and not a definitive identification of each and every source IP.
With positive IP identification possible for layer 7 HTTP attacks, one must establish criteria for how quickly to block a particular source IP. Our current sensitivity level adjustment for layer 7 HTTP attacks is based on the number of attackers seen before declaring an attack event. We are mindful that some apparent "attackers" are legitimate computers experiencing a glitch: under normal networking conditions, good computers may exhibit bot-like behaviors when their software has a brief "hang" or "blue screen" or "slow response." With their complex Operating Systems and applications, modern computers can stall and generate packets that resemble a DDoS attack.
We need to control the instances we count these stalled computers as attackers, because once a Layer 7 attack is recognized and filtered, an offending source IP will be blocked from accessing the victim IP for the range of time configured. Knowing that false postives can occur, RIOS software will place a source IP into the block list only after it has made more than a few offenses.
Even though every offending IP is not blocked immediately, the network operator should be aware of every instance. Therefore, all Layer 7 attackers are tracked via the filter list.
The software adds a new Victim Destination IP only if that Victim sees sufficient attacking source IPs generating sufficient attacking sessions at the same time. Thus for Layer 7 attacks, an attack is defined as a certain number of simultaneous bad sessions. The operator can redefine when an attack event has started by increasing or decreasing the sensitivity level, which will raise or lower the threshold of tolerance for simultaneous bad sessions.
This tolerance adjustment gives the operator discretion on how much attack traffic will "leak through" during an attack. The operator decides priorities, knowing that increasing the speed and completeness with which an attack is stopped will likely increase the of number of false positives.