Aggregate Request Metrics for DDoS Traffic Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network servers face challenges in distinguishing malicious traffic from legitimate traffic during Distributed Denial-of-Service (DDoS) attacks, particularly when IP addresses used are from proxies or virtual private networks, leading to difficulty in detection and resource-intensive blacklist management.
Innovation Solution
Classify network requests using multiple request classifiers, including membership filters like Bloom filters, to determine an aggregate request control metric, allowing nuanced treatment of requests based on historical interactions and classifier metrics, and instructing network controllers accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional blacklist management is used to detect malicious traffic, then detection capability is provided, but computational resources are excessively consumed and scalability is reduced
Solution Approach 1:
The patent segments the detection task into multiple independent request classifiers, each handling specific classification conditions. This divides the large-scale blacklist management problem into smaller, manageable units that can be processed in parallel, reducing computational overhead while maintaining detection reliability.
Solution Approach 2:
The system applies partial classification by selecting only the relevant request classifiers needed for each specific network request based on satisfaction of classification conditions. This avoids applying all possible classifiers to every request, significantly reducing computational resources while maintaining effective detection capability.
2Measurement precision
If multiple request classifiers are applied to each network request, then discrimination accuracy between malicious and legitimate traffic is improved, but system complexity increases
Solution Approach 1:
The system dynamically selects and applies only the relevant request classifiers needed for each specific network request based on the satisfaction of classification conditions. This dynamic approach maintains high discrimination accuracy through multiple classifiers while managing system complexity by avoiding unnecessary classifier applications.
Solution Approach 2:
Different request classifiers are applied selectively to different network requests based on their specific characteristics and the satisfaction of classification conditions. This local quality approach ensures high discrimination accuracy for each request type while managing overall system complexity through targeted application.
3Measurement precision
If aggregate request control metric is calculated from multiple classifier metrics, then traffic discrimination accuracy is enhanced, but processing time increases
Solution Approach 1:
The system calculates the aggregate request control metric using only the subset of classifier metrics that are actually applied to each network request, rather than computing all possible classifier metrics. This partial computation approach enhances traffic discrimination accuracy while minimizing processing time by avoiding unnecessary calculations.
Data Source
AI summary
Control of network traffic in a network is provided, including classifying a network request from a network source address using request classifiers selected from a plurality of request classifiers based on the network request satisfying classification conditions of the selected request classifiers, associating the network request with each classifier metric corresponding to the selected request classifiers, aggregating the classifier metrics associated with the network request to determine an aggregate request control metric of the network request, and instructing a network traffic controller to operate on the network request based on whether the aggregate request control metric satisfies a request control condition. Each of the plurality of request classifiers is associated in memory with a corresponding classifier metric.