Detecting attacks on web sites/applications

[Kishorebk]

We have number of external facing web sites/applications which are often being targeted, using different attacks. I want to create a query which can identify any scanning or potential DOS attack on the sites.

Also can HTTP status codes can be used to detect attacks? and how can standard deviation be used in identifying the attack.

Thanks
Kishore

[pramit46 · Accepted solution]

You form the query based on the requirements.

You can start with the following,

1. I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.

2. List down the response times against those IPs, and also the number of hits they make.

You can start with this and then enhance the query as required.

[pramit46]

I don't remember on top of my head right now, but I guess, you can try to look into access_combined and see if you can find any hint there.

[Kishorebk]

How do you suggest i record the response time for the IP's