[3SidedSquare]

this is a horrible way of doing it. When a user connects to a web page he connects to the server first through an IP and a port (thats all a url is, a masked IP address on port 80, 443 or 8080). A trust system would work if you're trying to stop forum post bombs but not DoS or DDoS attacks and even then it would be inefficient.

Oh god this is old... But I think you misunderstand the DoS method I'm trying to protect against. While it's certainly possible to DoS by having an upload bandwidth larger than your target's download, that's not the purpose of this method. This would protect against attacks that attempted to hit limits on server resources. (think slowloris, or some chernobyl packet)

[Eclipse]

What about regular users that use Tor, proxies, or a VPN? It's a pretty good idea, just needs some work.

I bet some kid makes a million of this idea tommorow.

[cr33pyguy]

I bet some kid makes a million of this idea tommorow.

Someone who had to hire people to code it for him.

[superMAUS]

What? I was simply saying that "SELECT x from y WHERE z LIKE a" is a really, really, slow search, and therefore uses lots of computation time. By sending enough requests that force you to do that with my IP, your SQL server wouldn't respond very fast, if at all.

Especially with large databases, it becomes simply impractical.

[3SidedSquare]

Especially with large databases, it becomes simply impractical.

Consider the following:

1) Connection from client to server is established (unavoidable)
2)The server checks to see if it is in a "high traffic" time
3) The connection origin is checked against "trusted" ip's (I know I said database, but hey, it was an idea in it's infancy. It seems like it could work much faster if if ip's were stored in a tree in memory, since it's a white list and not a blacklist, it should fit for a while)
4) a - the ip is not trusted, and is dropped
b - the ip is trusted, and the server can take more time and resources to serve the request.

The only reason I mention the tree is because a database is not really needed. The ip's don't even have to be stored, just the "trust" levels in the correct position in the tree. Give me a sec and I'll write some pseudo code.

threshold is the threshold trust level for high-traffic times
conn is the connection object
head is a tree of trust levels, according to the ip address, with 10 children for every parent. (0-9)
isHighTraffic is a method that determines if the server is in a high traffic time, returns boolean
serveRequest is a method that serves the request, given a connection object.

Code:

function connect (conn) { if(!isHighTraffic) { serveRequest() } else { if(trusted(conn.getIP(), head) { serveRequest() } } } function trusted(integer i, treeNode parent) //May need some formating, but expect the integer as a 12-digit integer, may need to be a long long int, depending on language { if(i%10 == i) //If the digit is the last one left { return parent.hasChild(i) && parent.get(i) > threshold //Find if the final digit of the ip is "trusted" } int leftDigit = i/(10^i.digits()) if(parent.hasChild(leftDigit) // Just keep going recursively though the tree { return trusted(i%10^i.digits()) } //If we haven't already gone back to recursion, accepted the ip, it means the ip is not even on the list of "trusted" ip's return false }

I'm not going to ask everyone to read the entire thread through before posting, but please see post #29(page 3) of this thread.

[ICE_]

This sounds like my first version of ALBATROSS (www.ironheartsecurity.net/products.html) but its a little different. I guess if you're looking strictly at limits it would be useful but its not easy to make, i promise

edit: also, sorry for grave digging... I saw it and was interested

[3SidedSquare]

This sounds like my first version of ALBATROSS (www.ironheartsecurity.net/products.html) but its a little different. I guess if you're looking strictly at limits it would be useful but its not easy to make, i promise

edit: also, sorry for grave digging... I saw it and was interested

Hey, I remember you now, you were in Dark Net Assassins way back when...

Yeah, this is meant to save server resources, especially if a DoS is constructed to request pages that take a lot of work to serve.

[ICE_]

Hey, I remember you now, you were in Dark Net Assassins way back when...

Yeah, this is meant to save server resources, especially if a DoS is constructed to request pages that take a lot of work to serve.

Oh lord, darknet assassins. those were the days. Yea, in that case it's somewhat useful. Hard to write (trust me, i've done it) but useful