Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Lets assume a botnet is attacking a website by HTTP GET flooding. To find the bots, the only way seems to be finding the similarities of the HTTP GET requests considering the URL and header fields, since the requests are sent by some script. Is this true? The URL could be crafted by the bot to contain some parameter with random fields. The headers are: HOST, Referer, User-Agent, Accept, ...
Does this idea of similarity measure work?
Yes, this is generally how Application DDoS attacks mitigated.
Some Anti-DDoS services will only rely on signature but high quality DDoS Protection providers will use a combination of signature and behavior based identification methods and combine them with challenges (JS execution, Cookies etc) to single-out and block malicious bot traffic and prevent false positives.
The only thing I have to add here is that you'll need to use a proxy - preferably more than one - if you want to get this to work properly.
Obviously, using you main server for filtering is obviously unadvised, as DDoS attack will deplete resources even before (and during) the filtering process.
If the requests generated by the botnet have a distinguishable pattern from legitimate traffic, then you can manually write rules in the firewall or web server to block these requests. A more advanced product could figure out those patterns and block them automatically.
http://code.google.com/p/mod-dosblock/ is an Apache module that helps against denial of service by allowing you to write rules about the HTTP headers and about the rate those requests come in.
The quality of the denial of service tool, meaning how well it simulates legitimate traffic, would make the detection easier or impossible.
The attack can be mitigated at several levels. If the attack is coming from known bot members, the firewall can block those. If the attack pattern is determinable then it could be blocked by intrusion prevention systems or by the application itself. Note the IP's determined by the IPS/application can be fed back to the firewall to add the offenders to the block list. If the attack pattern is not determinable and the bad IP's are not known, then some sort of while listing may need to be done to allow some known subset of the valid traffic thru.
Note ISP's sell ddos mitigation services and use more sophisticated techniques in addition to those above since they can observe the traffic 'upstream' of the victim server and can compare across different victims and bots so their dedicated 'scrubbers' have more to work with. So one recourse is to purchase one of those services. It's better to do that a priori - charges tend to be higher when you are already under attack.
