['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'anomaly', 'anomaly', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'http', 'http', 'fileinfo', 'http']
src_ip: 172.16.0.1, src_port: 37734, dest_ip: 192.168.10.50, dest_port: 80, event_type: flow, proto: TCP, flow_pkts_toserver: 5, flow_pkts_toclient: 5, flow_bytes_toserver: 687, flow_bytes_toclient: 2321, flow_age: 410, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 10, flow_pkts_toclient: 6, flow_bytes_toserver: 1031, flow_bytes_toclient: 11999, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 8, flow_bytes_toserver: 826, flow_bytes_toclient: 12131, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 7, flow_bytes_toserver: 891, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 854, flow_bytes_toclient: 11999, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 7, flow_bytes_toserver: 814, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 842, flow_bytes_toclient: 11999, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 7, flow_bytes_toserver: 860, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 7, flow_bytes_toserver: 767, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 6, flow_pkts_toclient: 6, flow_bytes_toserver: 770, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 839, flow_bytes_toclient: 11999, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 6, flow_pkts_toclient: 6, flow_bytes_toserver: 744, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 10, flow_pkts_toclient: 7, flow_bytes_toserver: 1209, flow_bytes_toclient: 12150, flow_age: 29, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?IIIBQUAV=BMJWQEU, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/ERXOLDXMS, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?IIIBQUAV=BMJWQEU, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/ERXOLDXMS, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?HLWEPYODTO=BLZYJP, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/KPDLJGMAJO, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2622 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?HLWEPYODTO=BLZYJP, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/KPDLJGMAJO, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2622, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 2622, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?YPREJFVQV=XOKST, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_refer: http://www.usatoday.com/search/results?q=RTOBWP, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?TXGZUENYLI=CARNCXLEHI, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.6 Safari/532.1, http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=LIIIA, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8414 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?TXGZUENYLI=CARNCXLEHI, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.6 Safari/532.1, http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=LIIIA, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8414, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 8414, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?OGD=TEA, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=HUWIYWG, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?OGD=TEA, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=HUWIYWG, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?AHR=FUR, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=BAAXC, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?AHR=FUR, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=BAAXC, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?CCRGIKCET=MMWPM, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Win64; x64; Trident/4.0), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/YPAOBBAECJ, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11321 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?CCRGIKCET=MMWPM, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Win64; x64; Trident/4.0), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/YPAOBBAECJ, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11321, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11321, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?IWGQPBN=ZUUMX, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=PVINOIAO, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2622 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?IWGQPBN=ZUUMX, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=PVINOIAO, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2622, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 2622, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?PQB=AFJO, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=QIKOOICVX, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 1442 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?PQB=AFJO, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=QIKOOICVX, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 6966, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?FZYRN=XDEOPZUNG, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_refer: http://www.usatoday.com/search/results?q=DREMC, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 1450 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?PIQMLD=UTF, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/TOKSWI, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 1442 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?PIQMLD=UTF, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/TOKSWI, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 6966, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 6966, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?yJR=O45&j15mK=bSvfqtchH&xYTVbDt=mBCsCgx27ylsWV&VQqOkytWD=JGTSPS7Mlq06e, http_http_user_agent: Mozilla/5.0 (Linux x86_64; X11) AppleWebKit/537.9 (KHTML, like Gecko) Version/5.1.3 Safari/537.31, http_http_refer: http://www.yandex.com/bhSOFc?ocfJuxd=ycUnOQxxunSmEaxIhyUi&Ncjwr=I0o4ItuwvGOPKcthQY1&wc8T=6vFNuAG3sF&Gbyt1=Q8j65NwwRP&8ppTalhD=Yv0PISISQV, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 47
The network event indicates a DoS Slowhttptest. DoS Slowhttptest attacks involve sending partial HTTP requests at a slow rate to keep connections open. Typically, the logs show multiple connections with minimal data exchange and prolonged open states, aiming to exhaust the target server's resources. Additionally, the logs contain multiple `anomaly` events indicating `APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION` and `UNABLE_TO_MATCH_RESPONSE_TO_REQUEST`, which is consistent with incomplete HTTP requests. These characteristics align with the behavior of DoS Slowhttptest attacks, which aim to overwhelm the server by keeping numerous connections open with partial and incomplete requests.
classification: Attack
justification: The network event indicates a DoS Slowhttptest. DoS Slowhttptest attacks involve sending partial HTTP requests at a slow rate to keep connections open. Typically, the logs show multiple connections with minimal data exchange and prolonged open states, aiming to exhaust the target server's resources. Additionally, the logs contain multiple `anomaly` events indicating `APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION` and `UNABLE_TO_MATCH_RESPONSE_TO_REQUEST`, which is consistent with incomplete HTTP requests. These characteristics align with the behavior of DoS Slowhttptest attacks, which aim to overwhelm the server by keeping numerous connections open with partial and incomplete requests.