Adaptive Union File System for DeOS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are inadequate in effectively protecting computer networks from destruction of service (DeOS) attacks, which involve the intentional destruction of data, leading to service inhibition and data loss, and existing backup strategies are costly and result in loss of system state deltas.
Innovation Solution
An adaptive union file system approach is implemented, where uncommitted changes are journaled and validated in a sandbox environment using a machine learning-based anomaly detector to identify potential DeOS attacks, allowing for timely mitigation actions and rapid restoration to a stable state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If backup strategies are implemented to mitigate destruction of service attacks, then data recoverability is improved, but restoration time increases and system state deltas are lost
Solution Approach 1:
The patent implements preliminary action by maintaining continuous journal entries that record file system states in real-time before attacks occur. These journal entries are prepared in advance and can be rapidly applied during restoration, eliminating the need to perform time-consuming backup operations after an attack. The journaling mechanism continuously captures system state changes, so when a destruction of service attack occurs, the system can immediately restore to the pre-attack state using the pre-prepared journal entries.
2Device complexity
If traditional file system protection methods are used, then implementation simplicity is maintained, but detection precision of DeOS attacks deteriorates
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of a journaling layer that sits between the file system and the attack vector. This journal intermediary captures and records all file system operations and states, providing a detailed audit trail that enables precise detection of destruction of service attacks. The journal entries serve as an intermediary record that can be analyzed to detect malicious patterns without requiring complex real-time monitoring of every file operation, thus maintaining implementation simplicity while improving detection precision.
Data Source
AI summary
In one embodiment, a device maintains a journal of uncommitted changes to a file system of the device in a layer that is hot-swappable with a writable container layer. The device augments the journal with metadata regarding a particular uncommitted change to the file system of the device. The device applies, within a sandbox environment of the device, a machine learning-based anomaly detector to the particular uncommitted change to the file system and the metadata regarding the change, to determine whether the particular uncommitted change to the file system is indicative of a destruction of service attack on the device. The device causes performance of a mitigation action when the machine learning-based anomaly detector determines that the particular uncommitted change to the file system is indicative of a destruction of service attack on the device.