Abnormal Host Detection in EVPN Using MAC Address Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Ethernet Virtual Private Networks (EVPN), attackers can overwhelm edge devices with large numbers of ARP packets, wasting resources and reducing processing performance, as existing methods require controllers to analyze each ARP packet, leading to high workload and resource consumption.
Innovation Solution
A method that involves obtaining host information from a controller and routing information from a routing management device, allowing a data processing device to analyze whether a host is abnormal by comparing the information, thereby reducing the controller's workload and improving performance by shifting the analysis to a big data processing system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the controller analyzes each ARP packet to identify abnormal hosts, then the accuracy of anomaly detection is improved, but the workload and resource consumption of the controller increases significantly
Solution Approach 1:
The patent segments the anomaly detection function from the controller and assigns it to a dedicated data processing device. The controller only collects ARP packets and forwards them, while the data processing device performs the complex analysis by comparing source MAC addresses against the MAC address table. This segmentation reduces controller workload while maintaining detection accuracy.
Solution Approach 2:
The patent introduces a data processing device as an intermediary between the controller and the anomaly detection process. This intermediary device handles the resource-intensive task of analyzing ARP packets and identifying abnormal hosts, allowing the controller to focus on its core functions without being overwhelmed by processing demands.
2Reliability
If the controller processes all ARP packets for anomaly detection, then comprehensive monitoring is achieved, but the processing performance and resource efficiency deteriorate
Solution Approach 1:
The patent divides the monitoring system into two functional segments: the controller responsible for packet collection and forwarding, and the data processing device responsible for analysis and identification. This segmentation enables comprehensive monitoring coverage while distributing processing loads to maintain high productivity.
Solution Approach 2:
The data processing device autonomously performs the analysis of ARP packets by independently comparing source MAC addresses against the MAC address table obtained from the controller. This self-service capability eliminates the need for the controller to process each packet, thereby maintaining comprehensive monitoring while significantly improving overall system processing performance.
3Loss of time
If ARP packet analysis is performed at the controller, then real-time detection is possible, but resource consumption and processing overhead increase
Solution Approach 1:
The data processing device acts as an intermediary that handles resource-intensive ARP packet analysis, allowing the controller to maintain real-time detection capabilities without consuming excessive resources. The intermediary processes packets efficiently using the MAC address table, enabling rapid identification of abnormal hosts while conserving controller energy and computational resources.
Data Source
AI summary
The present disclosure provides a method and an apparatus for monitoring an abnormal host, and a data processing device. The method includes: host information of a deployed host is obtained from a controller, where the host information includes address information of the deployed host; routing information of a to-be-detected host is obtained, where the routing information includes the address information of the to-be-detected host; it is determined whether the address information of the deployed host includes the address information of the to-be-detected host; and it is determined that the to-be-detected host is an abnormal host when the address information of the deployed host does not include the address information of the to-be-detected host.