['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'anomaly', 'anomaly', 'anomaly', 'anomaly', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'http']
src_ip: 172.16.0.1, src_port: 45118, dest_ip: 192.168.10.50, dest_port: 80, event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 783, flow_bytes_toclient: 11999, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 849, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 6, flow_bytes_toserver: 858, flow_bytes_toclient: 11999, flow_age: 3, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 6, flow_pkts_toclient: 6, flow_bytes_toserver: 705, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 7, flow_bytes_toserver: 816, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 798, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 9, flow_pkts_toclient: 8, flow_bytes_toserver: 864, flow_bytes_toclient: 12131, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 6, flow_bytes_toserver: 891, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 5, flow_bytes_toserver: 819, flow_bytes_toclient: 11933, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 7, flow_bytes_toserver: 821, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 6, flow_bytes_toserver: 839, flow_bytes_toclient: 11999, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 9, flow_pkts_toclient: 5, flow_bytes_toserver: 1179, flow_bytes_toclient: 11970, flow_age: 12, flow_state: established, flow_reason: timeout, tcp_tcp_flags: 1b, tcp_tcp_flags_ts: 1a, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_psh: True, tcp_ack: True, tcp_state: fin_wait2 ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?MWXOTPJM=DOGYONGB, http_http_user_agent: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51, http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=KBELPND, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8414 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?MWXOTPJM=DOGYONGB, http_http_user_agent: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51, http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=KBELPND, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8414, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 8414, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?ESSYBHDMTK=QXKDPNZPIS, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=IWEQIW, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 1442 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?ESSYBHDMTK=QXKDPNZPIS, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=IWEQIW, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 6966, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?SXURTPVA=SSKXGDW, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US), http_http_refer: http://www.google.com/?q=WAYSQV, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?QGU=ZCM, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=HOYZHM, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?QGU=ZCM, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=HOYZHM, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?JHT=EMRANVNEH, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_refer: http://205.174.165.68/XXTHDD, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 2922 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?TLEOY=CZBX, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Win64; x64; Trident/4.0), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=OZYTLS, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 1442 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?TLEOY=CZBX, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Win64; x64; Trident/4.0), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=OZYTLS, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 6966, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?SSX=YBZV, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/LRJHBNZE, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?SSX=YBZV, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/LRJHBNZE, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?VXLLUEP=YADZV, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=GHYPZQ, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?VXLLUEP=YADZV, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=GHYPZQ, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?YBCYVRH=TDMA, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/DEFTTFVXKL, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 10 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?YBCYVRH=TDMA, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/DEFTTFVXKL, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11310, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?ZCEPQLOGR=PXZH, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=KILXUDAISZ, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 10 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?ZCEPQLOGR=PXZH, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=KILXUDAISZ, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11310, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?BQV=EGWSUKQGPM, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US), http_http_refer: http://205.174.165.68/ZENCFIOS, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 1450 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?HqshF3P=NReV3Ig5iO1WPmWNeG&M5euW=75Cs7C0l0P&SfmYWaiFW=VWLkTbp6X7&WLjM=EiRdInF0, http_http_user_agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/536.35 (KHTML, like Gecko) Version/6.0.5 Safari/536.23, http_http_refer: http://www.bing.com/GDwJsb?K0EsHRWjBh=vgD&GWNh422J=UXNhoK0b&laSsGgE=UuekTuxAUfsYsK&DNa=3YO8oWiFWGfrGyL&hAQv8B=XNyMh2CwFfxx3MbMC2jT&KOWJLsRVR=5iU8YNROLyg0, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0
The network event indicates a DoS Hulk. DoS Hulk attacks involve sending a high frequency of HTTP requests to overwhelm the target server. Typically, the logs show multiple connection attempts from the same source IP to the same destination IP, with each connection being short-lived and frequently timed out. These connections are characterized by repeated TCP flags such as SYN, FIN, RST, PSH, and ACK, minimal data exchange, and immediate termination. This pattern of behavior is consistent with DoS Hulk attacks, where the objective is to disrupt the target server's normal operations by overwhelming it with excessive requests.
classification: Attack
justification: The network event indicates a DoS Hulk. DoS Hulk attacks involve sending a high frequency of HTTP requests to overwhelm the target server. Typically, the logs show multiple connection attempts from the same source IP to the same destination IP, with each connection being short-lived and frequently timed out. These connections are characterized by repeated TCP flags such as SYN, FIN, RST, PSH, and ACK, minimal data exchange, and immediate termination. This pattern of behavior is consistent with DoS Hulk attacks, where the objective is to disrupt the target server's normal operations by overwhelming it with excessive requests.