Adaptive Flow Probe Rate Limiting for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems face challenges in securing large-scale computer networks against attacks while allowing for network adaptations, leading to potential dropped connections and undesirable behavior due to constrained response rates to mid-flow packets from unrecognized flows.
Innovation Solution
Implementing adaptive rate limiting of flow probes by sending probes from one service engine to others at a capped rate, adjusting the rate limit based on success indicators from recognized flows, to differentiate between normal operations and potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the maximum rate of responses to mid-flow packets is constrained to protect against attacks, then network security is improved, but connection drops and undesirable behavior increase due to inability to adapt to legitimate network changes
Solution Approach 1:
The patent implements dynamic rate limiting by continuously monitoring the success rate of flow probes and adjusting the response rate accordingly. The system transitions from static rate limiting to adaptive rate limiting where the maximum response rate is dynamically modified based on real-time network conditions and probe success rates, enabling the system to adapt to legitimate network changes while maintaining security against attacks.
Solution Approach 2:
The system employs feedback mechanisms by monitoring the success rate of flow probes sent to verify unrecognized flows. Based on this feedback, the system adjusts the rate of responses to mid-flow packets. When probe success rates indicate legitimate network operations, the system increases response rates; when indicating attacks, it maintains or reduces rates, creating a closed-loop control system that balances security and adaptability.
2Adaptability or versatility
If the rate of responses to mid-flow packets from unrecognized flows is increased to accommodate network adaptations, then connection drops are reduced, but network security deteriorates due to potential attack exploitation
Solution Approach 1:
The system uses feedback from flow probe success rates to intelligently adjust response rates. Flow probes are sent to verify unrecognized flows, and the success rate of these probes provides feedback on whether increased response rates are safe. This feedback mechanism allows the system to increase adaptability only when verified as safe, preventing attack exploitation while accommodating legitimate network changes.
Solution Approach 2:
Before increasing the response rate to mid-flow packets, the system performs preliminary verification by sending flow probes to confirm the legitimacy of unrecognized flows. This preliminary action ensures that rate increases are based on verified safe conditions, preventing premature rate increases that could be exploited by attackers while enabling safe adaptability improvements.
3Productivity
If flow probes are sent at high rates to quickly verify unrecognized flows, then network adaptability is improved, but system resources are consumed excessively and potential attacks are not filtered
Solution Approach 1:
The patent implements dynamic adjustment of flow probe rates based on current network conditions and success rate history. Rather than sending probes at constant high rates, the system adapts the probe rate dynamically - increasing it when verification speed is critical and decreasing it when resource conservation is needed or when success patterns indicate safe conditions, optimizing the balance between productivity and resource consumption.
Solution Approach 2:
The system changes the parameter of probe sending rate based on monitored success rates and network conditions. By adjusting this parameter dynamically rather than maintaining a fixed high rate, the system achieves high verification speed when necessary while conserving resources during normal operations or when attack patterns are detected, resolving the contradiction between productivity and energy loss.
Data Source
AI summary
A technique for performing adaptive rate limiting of flow probes is described. The technique includes sending a plurality of flow probes from a first service engine to at least one other service engine. The flow probes are sent at a rate that does not exceed a rate limit. A flow probe of the plurality of flow probes is generated in response to the first service engine receiving a mid-flow packet for a flow that is not recognized by the first service engine. A recipient service engine of the flow probe responds with a success indicator if the recipient service engine recognizes the flow. The technique also includes determining a success rate associated with success indicators received from the at least one other service engine and comparing the success rate with a first threshold. The rate limit is adjusted in response to a comparison result.