SurgeProtector

Also called a “throttle”. SurgeProtector is a security feature in some software that shuts off access to a user after a huge amount of access in a short amount of time. A measure taken against DenialOfService attacks, inadventant overloading of a site, and spambot attacks.

CategoryHardSecurity

Problems

In a recent “attack” by a Chinese government IP, it was found that the default protection (allow 10 requests in 20 seconds) was not good enough, because all the attacked wikis were on the same shared host, resulting in server overload. In a first reaction, the protection was tightened (allow 10 requests in 100 seconds), which proved to be annoying for human readers.

What can we do?

  1. Find better parameter values (20 requests in 200 seconds?)
  2. Attach different weights to different actions (a search counts as 10 hits?)
  3. Adaptive protection (increase the protected window for a specific IP by 10 seconds every time the surge protector is triggered?)

Related

An analogous mechanism has been [proposed by Matthew Williamson] to slow the spread of viruses in computer networks.

Solutions for spam seems to be applicable in protecting wikis from attacks. Thinking about how to protect against large-scale bot attacks, I can think of two other strategies (both of which were proposed for blocking spam):

Discussion

Alex, I keep bumping up against the “Too many connections for EvanProdromou” error on CW. Is this some kind of SurgeProtector? I think it might have something to do with pipelining – my browser (Mozilla) may be keeping a lot of connections open. I also use tab browsing to follow links, so I can keep reading where I left off.

Anyways, this is driving me nuts.

I experienced this too after uploading sigis empty picture this evening, now everything seems fine. I used firefox on winxp at that time.

same here, and i didn’t actually do any tab browsing off CW, though i have no idea how many connections my browser might keep open anyway (opera). i was getting this message a lot just now, when just quickly reading through pages that had RC. (just reading, not editing.)

Yes, there was a Chinese government site hitting my wikis every few seconds, driving the load on the shared server up. I enlarged the protected window, and waited for some time. Today I saw that the Chinese IP was still hitting us, and I asked the guys from thinkmo.de to just block that IP. With the block in place, I reduced the protected window back to the default – 10 hits in 20 seconds.

HelmutLeitner reported on the WikiChannel that he has been using 100 hits in 5 minutes for over two years.

What about Wiki blocking people behind a proxy ?

This problem remains unresolved. If you have a username set, the surge protection used by Oddmuse will keep a separate hit count for your username. Username trumps IP number. That’s a tiny bit better.

EditNearLinks: CategoryHardSecurity DenialOfService

Languages:

The same page elsewhere:
MeatBall:SurgeProtector