['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'anomaly', 'anomaly', 'http', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'http', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http']
src_ip: 172.16.0.1, src_port: 40874, dest_ip: 192.168.10.50, dest_port: 80, event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 5, flow_bytes_toserver: 883, flow_bytes_toclient: 11933, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 6, flow_bytes_toserver: 829, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 9, flow_pkts_toclient: 6, flow_bytes_toserver: 901, flow_bytes_toclient: 12010, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 7, flow_bytes_toserver: 831, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 10, flow_pkts_toclient: 5, flow_bytes_toserver: 1356, flow_bytes_toclient: 11933, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 780, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 7, flow_bytes_toserver: 752, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 772, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 6, flow_bytes_toserver: 888, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 7, flow_bytes_toserver: 854, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 7, flow_bytes_toserver: 870, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 4, flow_bytes_toserver: 757, flow_bytes_toclient: 3797, flow_age: 23, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?JSIUWPH=VIK, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_refer: http://205.174.165.68/WTAYDAAHT, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 10 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?UNXYYTDTWF=QTLVGKVD, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/JGFUYIAZRO, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 10 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?UNXYYTDTWF=QTLVGKVD, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/JGFUYIAZRO, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11310, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?SSFI=FIJIYMDU, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=TJNSWPL, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?SSFI=FIJIYMDU, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=TJNSWPL, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?NIZME=NHWYUYOZHE, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=BPQQL, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 4070 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?NIZME=NHWYUYOZHE, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=BPQQL, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 4070, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 4070, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?XJJSHUKH=FSTC, http_http_user_agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.3) Gecko/20090913 Firefox/3.5.3, http_http_refer: http://www.usatoday.com/search/results?q=DIOUTB, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 10 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?MWLN=KCXHCJNLKG, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_refer: http://engadget.search.aol.com/search?q=LUKXWQF, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 1468 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?QIBDLEB=VUNMIGMC, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_refer: http://www.google.com/?q=DFEUM, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?MYEKUQWX=CBHURJXEG, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=JIOBOQ, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 1442 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?MYEKUQWX=CBHURJXEG, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=JIOBOQ, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 6966, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?IVJSZ=IGKIN, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=LLBUOIUO, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8414 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?IVJSZ=IGKIN, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=LLBUOIUO, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8414, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 8414, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?AEYJCLCKM=FVZCR, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.1) Gecko/20090718 Firefox/3.5.1, http_http_refer: http://www.google.com/?q=RWHOJB, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?NEQLVYR=FSYV, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/UTSBBDW, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?NEQLVYR=FSYV, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/UTSBBDW, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?NxJte1e=wJWqX5dCLtRjf5rYR, http_http_user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/535.22 (KHTML, like Gecko) Chrome/11.0.730.79 Safari/535.25, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0
The network event indicates a DoS Hulk. DoS Hulk attacks involve sending a high frequency of HTTP requests to overwhelm the target server. Typically, the logs show multiple connection attempts from the same source IP to the same destination IP, with each connection being short-lived and frequently timed out. These connections are characterized by repeated TCP flags such as SYN, FIN, RST, PSH, and ACK, minimal data exchange, and immediate termination. This pattern of behavior is consistent with DoS Hulk attacks, where the objective is to disrupt the target server's normal operations by overwhelming it with excessive requests.
classification: Attack
justification: The network event indicates a DoS Hulk. DoS Hulk attacks involve sending a high frequency of HTTP requests to overwhelm the target server. Typically, the logs show multiple connection attempts from the same source IP to the same destination IP, with each connection being short-lived and frequently timed out. These connections are characterized by repeated TCP flags such as SYN, FIN, RST, PSH, and ACK, minimal data exchange, and immediate termination. This pattern of behavior is consistent with DoS Hulk attacks, where the objective is to disrupt the target server's normal operations by overwhelming it with excessive requests.