[3SidedSquare]

Hey guys, so I was sitting around eating cherrys and and drinking lemon pop when I realized; "I think I can stop people's services from getting DOS'd!"

So here it goes:

A service keeps a database of "regular" IP address

When a user that has never connected to the service before connects, the server adds them to the database, along with the time the connection was created. If the time is greater than threshold X hours, the time is updated with the new time, and the ip's "Trust counter" goes up. If the time is not greater than threshold X hours, nothing happens.

During times of high-traffic, the server will block any requests not already on the database, then all users not "trust" y or higher, where y varies dependent on server traffic.

In this way, only users that frequent the service will be able to access it during times of high traffic, and if there should ever be any form of DDOS, the server will take on what it can handel of the 'new users', while allowing most legitimate traffic through.

I need you guys to punch as many holes as you can in my idea. Go!

[ErroraBorealis]

This could help, but i think i lot of users who DoS forums and such where wronged by a mod or admin first, and had spent some time there. Revenge. SO they would most likely be past the threshhold. Not to mention, some people log in and stay logged in 24/7, while some get on for five minutes and post a shit ton at one and get off for the day.

[3SidedSquare]

This could help, but i think i lot of users who DoS forums and such where wronged by a mod or admin first, and had spent some time there. Revenge. SO they would most likely be past the threshhold. Not to mention, some people log in and stay logged in 24/7, while some get on for five minutes and post a shit ton at one and get off for the day.

I understand where you're comming from, but a single trying to DoS a service is likely to fail, as services can usually hold a few gigabytes or so down, and Google Fiber gives a maximum of 1 gigabyte up.

Additionally, people who 'stay logged in 24/7', at least on a website, aren't submitting new page requests, and therefore will not be given an increase in "trust", while people that post a lot in a short ammount of time will be subbmitting many requests, and therefore will increase in trust.

Ruleing out a DoS, I'm more concerned with DDoS, and the extensive booter networks that have become ever so popular, as well as 'Tor's hammer' which I belive has become the go-to tool of choice lately.

[ErroraBorealis]

This could help, but i think i lot of users who DoS forums and such where wronged by a mod or admin first, and had spent some time there. Revenge. SO they would most likely be past the threshhold. Not to mention, some people log in and stay logged in 24/7, while some get on for five minutes and post a shit ton at one and get off for the day.

I understand where you're comming from, but a single trying to DoS a service is likely to fail, as services can usually hold a few gigabytes or so down, and Google Fiber gives a maximum of 1 gigabyte up.

Additionally, people who 'stay logged in 24/7', at least on a website, aren't submitting new page requests, and therefore will not be given an increase in "trust", while people that post a lot in a short ammount of time will be subbmitting many requests, and therefore will increase in trust.

Ruleing out a DoS, I'm more concerned with DDoS, and the extensive booter networks that have become ever so popular, as well as 'Tor's hammer' which I belive has become the go-to tool of choice lately.

Makes sense. Still though, the server has to accept the requests being sent, but no protection will completely work, but it would keep the site up for the frequenters. Although ajax detects how long someone is logged in, your system most likely wouldn't, that's what I was thinking of. Someone should try to make this system.

[Unmasked]

All someone has to do is browse the site naturally for x amount of time, once they are on the trusted list if they bust out a 7layer attack that server will drop like a fly. Better yet an attacker could spoof his attack to look like the IPs of users on the trusted table. It would indeed be harder to bring down but if someone wanted to take it down they could.

[Oni]

It is an interesting idea and would no doubt improve things. Cloudflare could easily implement such a thing too. There are valid concerns with them gaining trust and then being used for a L7 attack though.

[Adorapuff]

A system like this in place for telephone DDos attacks.

[ErroraBorealis]

The trusted layer7 attacks would obviously be a problem, but then again, who would know this system is in place without it being public information? We are thinking like we are trying to attack our own site. Who tries to see what kind of protection, besides cloudflare, is in place before attacking? Pretty much nobody, as there is no way to tell. People trying to get revenge are really the only problem IMO. More common for hacking sites who have a lot of competition or members who are assholes or sites that deserve the attacks anyway.

Off-Topic: Does anyway have any resources to learn IP-spoofing?

[Twitty]

Wouldn't work,
Would make way to much queries to the database to check if the IP's that's attacking is "trusted".
It would just make the server running slower by making those extra queries to the database.

[Ultimatum]

This doesn't address, the method of actually thwarting an attack, just a series of processes, that you would hope to work. For example, in "high-traffic time", how do you block it? Are you going to write a script?