Multi-Granularity Address Defense for Carpet-Bombing DDoS Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDoS attack detection methods in protection devices struggle to accurately detect and defend against DDoS attacks, particularly in scenarios where attackers use carpet-bombing techniques, leading to resource overload and reduced network security.
Innovation Solution
Implementing an attack defense method that divides protected network addresses into multiple granularities, allowing for flexible traffic statistics collection and defense processing on address ranges of varying sizes, enhancing detection accuracy and resource efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the protection device uses a fixed detection threshold for single host traffic statistics, then the detection method is simple, but the detection accuracy deteriorates and cannot effectively detect DDoS attacks
Solution Approach 1:
The patent segments the detection task by dividing address ranges into multiple granularities (first granularity and second granularity). Instead of using a single fixed threshold for all traffic, the system collects traffic statistics at different granularities and applies appropriate detection thresholds for each level, enabling effective detection of both targeted attacks on single hosts and distributed attacks across multiple addresses.
2Reliability
If the protection device collects traffic statistics for all address ranges at a single granularity, then the detection coverage is complete, but the resource consumption increases and defense effect deteriorates
Solution Approach 1:
The patent implements dynamic granularity selection based on attack patterns. The system monitors traffic at different granularities and adjusts the detection scope accordingly. When attacks are detected at a coarser granularity, the system can focus resources on that specific level rather than continuously monitoring all individual hosts, thereby reducing resource consumption while maintaining effective detection coverage.
Data Source
AI summary
An attack defense method, where addresses in a protected network are divided into a plurality of address ranges that include a first address range and a second address range. The first address range is a proper subset of the second address range, or the second address range is a proper subset of the first address range. A protection device or a server coupled to the protection device collect statistics on first traffic that passes through the protection device. When the statistics exceed a first threshold, the protection device performs defense processing on the first traffic. The first traffic is of a target type and has a destination address that is in the first address range. The first address range and the second address range are address ranges of different granularities.