(05-27-2014, 05:07 AM)ICE_ Wrote: this is a horrible way of doing it. When a user connects to a web page he connects to the server first through an IP and a port (thats all a url is, a masked IP address on port 80, 443 or 8080). A trust system would work if you're trying to stop forum post bombs but not DoS or DDoS attacks and even then it would be inefficient.

(05-27-2014, 10:03 AM)Aurora Wrote: I bet some kid makes a million of this idea tommorow.

(09-06-2013, 02:36 AM)w00t Wrote: What? I was simply saying that "SELECT x from y WHERE z LIKE a" is a really, really, slow search, and therefore uses lots of computation time. By sending enough requests that force you to do that with my IP, your SQL server wouldn't respond very fast, if at all.

(05-27-2014, 02:03 PM)antlers Wrote: Especially with large databases, it becomes simply impractical.

(09-08-2013, 11:47 PM)3SidedSquare Wrote: Consider the following:

1) Connection from client to server is established (unavoidable)
2)The server checks to see if it is in a "high traffic" time
3) The connection origin is checked against "trusted" ip's (I know I said database, but hey, it was an idea in it's infancy. It seems like it could work much faster if if ip's were stored in a tree in memory, since it's a white list and not a blacklist, it should fit for a while)
4) a - the ip is not trusted, and is dropped
b - the ip is trusted, and the server can take more time and resources to serve the request.

The only reason I mention the tree is because a database is not really needed. The ip's don't even have to be stored, just the "trust" levels in the correct position in the tree. Give me a sec and I'll write some pseudo code.

threshold is the threshold trust level for high-traffic times
conn is the connection object
head is a tree of trust levels, according to the ip address, with 10 children for every parent. (0-9)
isHighTraffic is a method that determines if the server is in a high traffic time, returns boolean
serveRequest is a method that serves the request, given a connection object.

Code:

function connect (conn) { if(!isHighTraffic) { serveRequest() } else { if(trusted(conn.getIP(), head) { serveRequest() } } } function trusted(integer i, treeNode parent) //May need some formating, but expect the integer as a 12-digit integer, may need to be a long long int, depending on language { if(i%10 == i) //If the digit is the last one left { return parent.hasChild(i) && parent.get(i) > threshold //Find if the final digit of the ip is "trusted" } int leftDigit = i/(10^i.digits()) if(parent.hasChild(leftDigit) // Just keep going recursively though the tree { return trusted(i%10^i.digits()) } //If we haven't already gone back to recursion, accepted the ip, it means the ip is not even on the list of "trusted" ip's return false }

(05-27-2014, 11:33 PM)ICE_ Wrote: This sounds like my first version of ALBATROSS (www.ironheartsecurity.net/products.html) but its a little different. I guess if you're looking strictly at limits it would be useful but its not easy to make, i promise

edit: also, sorry for grave digging... I saw it and was interested

(05-27-2014, 11:45 PM)3SidedSquare Wrote: Hey, I remember you now, you were in Dark Net Assassins way back when...

Yeah, this is meant to save server resources, especially if a DoS is constructed to request pages that take a lot of work to serve.