Adaptive SYN Threshold for SDN Flood Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for detecting and mitigating SYN flood attacks in Software-Defined Networking (SDN) environments face performance overhead and inflexibility, particularly in large-scale networks, as current Intrusion Detection and Prevention Systems (IDPS) often result in significant response time delays and resource exhaustion.
Innovation Solution
An adaptive dynamic threshold-based kernel-level intrusion detection and prevention system is introduced, leveraging SDN capabilities to detect and mitigate SYN flood attacks by dynamically adjusting SYN thresholds using an additive-increase/multiplicative-decrease algorithm, and deploying Bloom filters and Aho-Corasick filters for efficient string matching, integrated with the Floodlight SDN controller as a REST API.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IDPS solutions (Snort, Zeek) are used for SYN flood attack detection, then security monitoring capability is provided, but significant performance overhead and response time delays occur
Solution Approach 1:
The patent implements dynamic threshold adjustment based on network traffic conditions. The SYN threshold is not fixed but adapts in real-time based on observed traffic patterns, allowing the system to respond more quickly to attacks while reducing false positives during normal operation. This dynamic adaptation resolves the contradiction by enabling fast response without sacrificing monitoring accuracy.
Solution Approach 2:
The system changes the parameter of SYN threshold values dynamically based on network conditions. By adjusting this critical parameter in real-time, the system can optimize its detection sensitivity and response speed, reducing both false alarms and response delays compared to static threshold approaches in traditional IDPS.
2Reliability
If traditional IDPS solutions are deployed in large-scale networks, then security coverage is provided, but inflexibility and resource exhaustion occur
Solution Approach 1:
The patent introduces dynamic threshold adjustment that adapts to changing network conditions and traffic patterns. This flexibility allows the system to maintain effective security coverage across large-scale networks while adapting to different network topologies and attack patterns, resolving the inflexibility problem of traditional IDPS.
Solution Approach 2:
The system performs self-adjustment of thresholds based on observed traffic patterns without requiring manual reconfiguration. This self-service capability enables the system to maintain optimal security coverage in large-scale networks while adapting automatically to changing conditions, eliminating the need for continuous manual intervention.
3Speed
If SYN threshold is set low for quick attack detection, then response speed is improved, but legitimate traffic is incorrectly blocked
Solution Approach 1:
The patent implements dynamic threshold adjustment that increases the SYN threshold when network conditions indicate normal traffic patterns and decreases it when attack patterns are detected. This dynamic behavior allows the system to maintain fast response to attacks while avoiding false blocking of legitimate traffic during normal operation.
Solution Approach 2:
The system uses feedback from network traffic observation to adjust the SYN threshold. By continuously monitoring traffic patterns and using this feedback to modify threshold values, the system can distinguish between legitimate traffic and attacks, responding quickly to threats while avoiding false positives through adaptive feedback-based adjustment.
Data Source
AI summary
Described herein relates to a system and method for the prevention of a malicious attack on a computing resource. In embodiments, the system may comprise the following, including but not limited to: (1) at least one processor; and (2) computer memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform operations including: (a) observing traffic flow of a network; (b) altering a SYN threshold value based on the observing of the traffic flow of the network; (c) comparing a metric of SYN messages submitted to the network; and (d) based on the comparison of the metric of SYN messages submitted, selectively engaging corrective action with the network.