AT16: Faulty Application
Definition
DDoS attackers take advantage of websites with poor designs or improper integration with databases. Using SQL-like injections, an attacker can generate requests that will lock up database queries. These attacks are highly specific and effective because they consume server resources (memory, CPU, etc.).
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Non-Spoofed | Yes | Small | Low | -- | Valid | -- | Low | Short | Low |
Defense Fundamentals
This algorithm limits what can be sent from client to host with a REGEX that compares incoming packet data to generalized packet data from good requests.
Currently, we have HTTP, mail and DNS (UDP) applications examination.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
You can hit Clear Filter List to remove all IPs from the filter list for this attack type. This is equivalent to running a Clear for all IPs under this attack type in Clear Filter List.
If you are changing filter settings, it is recommended you Clear Filter List after you have updated your settings to prevent addresses from getting blocked again before the new settings take effect.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |