RE: [Theory] Anti-DDOS by ip recognition 05-27-2014, 09:39 PM
#35
(05-27-2014, 02:03 PM)antlers Wrote: Especially with large databases, it becomes simply impractical.
(09-08-2013, 11:47 PM)3SidedSquare Wrote: Consider the following:
1) Connection from client to server is established (unavoidable)
2)The server checks to see if it is in a "high traffic" time
3) The connection origin is checked against "trusted" ip's (I know I said database, but hey, it was an idea in it's infancy. It seems like it could work much faster if if ip's were stored in a tree in memory, since it's a white list and not a blacklist, it should fit for a while)
4) a - the ip is not trusted, and is dropped
b - the ip is trusted, and the server can take more time and resources to serve the request.
The only reason I mention the tree is because a database is not really needed. The ip's don't even have to be stored, just the "trust" levels in the correct position in the tree. Give me a sec and I'll write some pseudo code.
threshold is the threshold trust level for high-traffic times
conn is the connection object
head is a tree of trust levels, according to the ip address, with 10 children for every parent. (0-9)
isHighTraffic is a method that determines if the server is in a high traffic time, returns boolean
serveRequest is a method that serves the request, given a connection object.
Code:function connect (conn) { if(!isHighTraffic) { serveRequest() } else { if(trusted(conn.getIP(), head) { serveRequest() } } } function trusted(integer i, treeNode parent) //May need some formating, but expect the integer as a 12-digit integer, may need to be a long long int, depending on language { if(i%10 == i) //If the digit is the last one left { return parent.hasChild(i) && parent.get(i) > threshold //Find if the final digit of the ip is "trusted" } int leftDigit = i/(10^i.digits()) if(parent.hasChild(leftDigit) // Just keep going recursively though the tree { return trusted(i%10^i.digits()) } //If we haven't already gone back to recursion, accepted the ip, it means the ip is not even on the list of "trusted" ip's return false }
I'm not going to ask everyone to read the entire thread through before posting, but please see post #29(page 3) of this thread.
![[Image: jWSyE88.png]](http://i.imgur.com/jWSyE88.png)
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)