Preventing slow and low attacks

A low and slow attack is a type of DoS attack that sends a small stream of traffic at a very slow rate. It targets application and server resources and is difficult to distinguish from normal traffic. The most popular attack tools include Slowloris and R.U.D.Y. Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to—but never completing—the request. Affected servers will keep these connections open, filling their maximum concurrent connection pool, eventually denying additional connection attempts from clients.

FortiWeb can detect slow and low attacks and generate attack logs for you to trace the source.

Configuring protection rules for slow and low attacks

You can configure FortiWeb to prevent the long-lasting HTTP transactions.

1. Go to Bot Mitigation > Threshold Based Detection.
2. Click Create New.
3. For Name, enter a name for the threshold based detection rule that can be referenced in bot mitigation policy.
4. For Tracking by, select one of the following options to define how FortiWeb counts occurrences for each detection module:
   • Client IP — Tracks requests by the source IP address. This is suitable when client identity is not available or when cookies are disabled.
   • Client ID — Tracks requests using the Client Management cookie, allowing FortiWeb to associate behavior with individual clients across sessions and IP changes. If this option is selected and the associated protection profile has not enabled Client Management, a prompt will appear.
     When Client ID is selected, detection modules offer Client ID Block Period actions in place of standard IP-based block actions.
     

   Note:

   • Slow Header Attack does not support tracking by Client ID due to its detection being performed at the TCP layer before full HTTP headers are available. Even when Tracking by is set to Client ID, FortiWeb uses Client IP for occurrence tracking in this case.

   • If you change Tracking by from Client ID to Client IP, any existing Client ID Block Period actions in the configuration must be manually updated.

5. Configure the slow attack detection settings:
   

   Slow Attack Detection
   HTTP Transaction Timeout	Specify a timeout value, in seconds, for the HTTP transaction. The default value is 60.
   Packet Interval Timeout	Specify the timeout value, in seconds, for interval between packets arriving from either the client or server (request or response packets). The default value is 10.
   Occurrence	Define the frequency that FortiWeb detects slow attack activities. The default value is 5.
   Within (Seconds)	Specify the time period, in seconds, during which FortiWeb detects slow attack activities. The default value is 100.
   Action	Select which action FortiWeb will take when it detects slow attack activities: Alert—Accept the connection and generate an alert email and/or log message. Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message. Deny (no log)—Block the request (or reset the connection). Period Block—Block subsequent requests from the client for a number of seconds. Also configure Period Block. Client ID Block Period—Block a malicious or suspicious client based on the FortiWeb generated client ID. This is useful when the source IP of a certain client keeps changing. This option takes effect only when you enable Client Management in the Server Policy. Also configure Period Block. When a Slow Header Attack is detected, FortiWeb automatically falls back to Client IP for occurrence tracking. If the configured action is Client ID Block Period, it will be enforced as an IP-based Period Block instead. The default value is Alert.
   Period Block	Enter the number of seconds that you want to block subsequent requests from a client after FortiWeb detects slow attack activities. The valid range is 1–3,600 seconds (1 hour). This setting is available only if Action is set to Period Block or Client ID Block Period.
   Severity	When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when it logs slow attack activities: Informative Low Medium High The default value is Medium.
   Trigger Policy	Select the trigger, if any, that FortiWeb will use when it logs and/or sends an alert email about slow attack activities. For details, see Viewing log messages.

6. Click OK.

See information on the threshold based detection rule, see Configuring threshold based detection.

In addition to the configurations in the threshold based detection rule, the following two commands in server-policy policy are also useful to prevent slow and low attacks that periodically add HTTP headers to a request.

config server-policy policy

edit "<policy_name>"

set HTTP-header-timeout <seconds_int>

set tcp-recv-timeout <seconds_int>

next

end

Variable	Description	Default
HTTP-header-timeout <seconds_int>	The amount of time (in seconds) that FortiWeb will wait for the whole HTTP request header after a client sets up a TCP connection. FortiWeb closes the connection if the HTTP request is timeout. The valid range is 0–1200. A value of 0 means that there is no timeout.	0
tcp-recv-timeout <seconds_int>	The amount of time (in seconds) that FortiWeb will wait for a client to send a request after the client sets up a TCP connection. FortiWeb closes the connection if the TCP request is timeout. The valid range is 0–300. A value of 0 means that there is no timeout.	0