AT9: Misused Application Attack
Definition
The attacker does not use bots to consume the system resources of a victim’s server. Rather, an attacker redirects valid clients belonging to a high traffic application, such as peer-to-peer services, to a victim server. The target victim is then overwhelmed with traffic from a group of misdirected computers trying to form a legitimate connection with its server. Once the traffic is misdirected towards the victim server, the attacker computer becomes untraceable by dropping from the network. The overwhelming connection requests received by the victim’s server depletes its system resources, resulting in performance degradation or a complete server shutdown.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Non-Spoofed | Yes | Small | Variable | -- | -- | -- | High | Short | -- |
Defense Fundamentals
This defense attempts to identify major applications and identifies if the source IP is generating reasonable packets to the known application. Currently, RioRey has a limited set of application profiles that cover some of the most popular applications. Over time, new application and controls may be introduced to address both new popular applications and new attacks.
- Applications covered are: basic email, p2p, some HTTP/HTTPS, port scanning, port sweeping.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur in Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Filter sensitivity | Level 5 (1-10) | This feature allows the user to adjust the sensitivity level of the filter for misused application attacks. The recommended default setting is level 5. To reduce filter sensitivity, lower the setting number. The higher the setting, the more sensitive the filter becomes. Due to the aggressiveness of the setting, Level 10 is liable to drop some good traffic. Alter the sensitivity settings gradually as needed. |
| Show Advanced Controls | Disabled | Enabling this control opens up all of the advanced controls for AT9 (listed below). By default, the controls will populate at their settings for the currently set filter sensitivity level. The advanced controls require careful configuration in order to work correctly. They should only be adjusted after direct consultation with RioRey. |
| Gate 1 Packet Threshold | ||
| Gate 2 Packet Threshold | ||
| Detector restart packet count | ||
| Attack Packet Threshold | ||
| Sample restart packet count | ||
| Minimal test sample periods | ||
| Minimal suspect percent allowed | ||
| Random SYN attack IP bucket count min. | ||
| Random SYN attack IP bucket value | ||
| Random SYN attack port bucket count min. | ||
| Random SYN attack port bucket value low | ||
| Target SYN attack IP bucket value high | ||
| Target SYN attack IP bucket value max (RIOS 6.2.0 or greater) | ||
| Target SYN attack port bucket value high | ||
| Block TCP port pairs (RIOS 7.0.0 or greater) | None | Hitting Add creates a new row of two text boxes, symbolizing the Source Port to Destination port TCP traffic to drop. Using the "*" character symbolizes a wild card. Wild cards can be used in either the Source or Destination for a given entry, but not both. Any TCP traffic matching the block port pair specified will be dropped as subtype 16 (shown below). Entries can be removed by hitting Delete. A maximum of 10 "Block" and "Allow" entries can be set up in a single Zone. |
| Only allow specified TCP port pairs (RIOS 7.0.0 or greater) | Disabled | Enabling this control enables entry of "Allow" Source to Destination port pairs. Unlike the "Block" specifications, only the traffic matching an "Allow" entry will be permitted in the zone. Traffic dropped due to not matching an "Allow" entry will be recorded as subtype 17 (shown below). |
| Allow TCP port pairs (RIOS 7.0.0 or greater) | None | Hitting Add creates a new row of two text boxes, symbolizing the Source Port to Destination port TCP traffic that should be allowed in the zone. Using the "*" character symbolizes a wild card. Wild cards can be used in either the Source or Destination for a given entry, but not both. Any TCP traffic NOT matching an allow port pair specified will be dropped as subtype 17 (shown below). Entries can be removed by hitting Delete. A maximum of 10 "Block" and "Allow" entries can be set up in a single Zone. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT9 | 1 | Port Sweep Attack |
| AT9 | 2 | Port Scan Attack |
| AT9 | 3 | High Connection Rate |
| AT9 | 16 | Source or destination port closed |
| AT9 | 17 | Source or destination port not allowed |