Adaptive Network Traffic Filtering for Fast DDoS Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing DDoS attack detection and mitigation systems rely on signature-based methods that require long-term learning processes, are computationally intensive, and have long response times, often leading to increased attack effectiveness due to the disruption of clean traffic and limited ability to adapt to changing attack vectors.

Innovation Solution

An adaptive control system that autonomously detects and mitigates DDoS attacks by analyzing packet flows in time and frequency domains, using predictive adaptive control and unsupervised learning to generate and distribute network filters, shaping flow dynamics with packet policing mechanisms.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If signature-based detection methods are used to identify DDoS attacks, then detection accuracy for known attacks is improved, but response time increases and the system cannot adapt to unknown attack signatures

Engineering Contradiction:

Improvedetection accuracyVSAvoidresponse time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary characterization of clean network traffic to establish baseline statistical models before attacks occur. These pre-built models enable immediate detection and response to anomalies without requiring time-consuming signature matching or learning processes during actual attacks.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces traditional mechanical signature-based pattern matching with statistical analysis and machine learning models that automatically detect anomalies based on deviations from learned traffic patterns, enabling faster and more adaptive detection.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Adaptability or versatility

If long-term learning processes are used to build detection models, then adaptability to various attack types is improved, but the system becomes computationally intensive and slower to respond

Engineering Contradiction:

Improveadaptability to attack typesVSAvoiddata processing capacity

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent applies statistical analysis and machine learning selectively to suspicious traffic patterns rather than processing all network traffic equally. This partial application of complex analysis maintains high adaptability while preserving data processing capacity for normal operations.

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If routing rules are propagated throughout the network to mitigate attacks, then attack mitigation effectiveness is improved, but clean network connections are disrupted and response time increases

Engineering Contradiction:

Improveattack mitigation effectivenessVSAvoidclean traffic disruption

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The system applies mitigation measures locally at the network edge where attacks are detected, rather than propagating routing rules throughout the entire network. This localized approach blocks malicious traffic at the source while preserving clean traffic flow through unaffected network paths.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent extracts and isolates malicious traffic patterns from legitimate network flow using statistical analysis, separating harmful packets for mitigation while allowing clean traffic to continue uninterrupted through the network infrastructure.

Inventive Principle:

Principle #2Taking out (Extraction)

4Object-affected harmful factors

If packet flows are blocked to stop DDoS attacks, then attack impact is reduced, but the system cannot distinguish between clean and dirty traffic leading to false positives

Engineering Contradiction:

Improveattack impactVSAvoidtraffic discrimination accuracy

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system dynamically adjusts detection parameters and thresholds based on learned traffic characteristics and attack patterns, optimizing the balance between blocking malicious traffic and allowing legitimate flow while minimizing false positives.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12574353B2Method and unit for adaptive creation of network traffic filtering rules on a network device that autonomously detects anomalies and automatically mitigates volumetric (DDoS) attacks

Publication Date: 2026.03.10 NAUKOWA I AKADCKA SIEC KOMPUTEROWA PANSTWOWY INST BADAWCZY

AI summary

The subject of the invention is the method of adaptive creating network traffic filtering rules on a network device that autonomously detects anomalies and adaptively mitigates volumetric (DDoS) attacks on at least one network device (4) based on actual network flows (3) and after separating them into isolated packet flows (9), recognizes potentially harmful network flows, and then configures or tunes the network filters (19) and packet policing means (17), wherein filtering rules (18) can be propagated to other network devices (27) and selects for further analysis the isolated packet flows (9) associated with at least one configured or tuned network filter (19).