Asymmetrical Routing Anomaly Detection via Distributed Traffic Feature Merging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems in computer networks face challenges in distinguishing between legitimate and malicious traffic flows, particularly in the presence of asymmetrical routing, which complicates the identification of Denial of Service (DoS) attacks and makes it difficult to model normal network behavior due to the directional nature of Internet traffic.
Innovation Solution
A distributed learning architecture that identifies asymmetrical routing by discovering missing traffic flows, electing a primary device to receive and process traffic characteristics from peer devices, and using machine learning-based anomaly detection to merge features from both directions of traffic flows for accurate modeling and anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If traffic flow characteristics are monitored at a single device in asymmetric routing, then device complexity is reduced, but measurement precision of complete traffic behavior deteriorates
Solution Approach 1:
The system divides the network into multiple monitoring segments, with each device independently monitoring local traffic flows. Each device captures traffic characteristics for flows passing through it, and these segmented measurements are later aggregated to form a complete picture of asymmetric traffic patterns without requiring one device to handle all monitoring complexity.
Solution Approach 2:
The system merges traffic flow characteristics from multiple devices by matching flows based on endpoint pairs. Device 1's observation of forward traffic and Device 2's observation of return traffic are combined to create a complete bidirectional flow profile, enabling precise measurement of asymmetric routing patterns while distributing monitoring complexity across multiple devices.
2Measurement precision
If traffic characteristics are collected from multiple devices, then anomaly detection accuracy is improved, but data transmission overhead increases
Solution Approach 1:
The system extracts only the essential traffic characteristics needed for anomaly detection from each device's complete traffic data. By selecting and transmitting only relevant flow features (such as endpoint pairs, protocol types, and traffic volumes) rather than complete packet captures, the system achieves accurate anomaly detection while minimizing data transmission overhead.
Solution Approach 2:
Each device performs preliminary processing of traffic flows locally by identifying and characterizing flows before transmission. Devices pre-process traffic data to extract meaningful features and filter out redundant information, reducing the volume of data that needs to be transmitted to the central anomaly detection system while maintaining detection accuracy.
3Reliability
If complete bidirectional traffic flows are monitored, then reliability of anomaly detection is improved, but device complexity increases due to need to track both directions
Solution Approach 1:
The system segments the bidirectional traffic monitoring task across multiple devices based on their positional roles in the asymmetric routing path. Device 1 monitors forward traffic while Device 2 monitors return traffic, with each device handling only one direction. This segmentation reduces individual device complexity while maintaining reliable detection through coordinated observation of both directions.
Solution Approach 2:
The system introduces a central coordinator that receives traffic flow characteristics from multiple devices and performs the matching and merging operations. This intermediary consolidates the complexity of tracking bidirectional flows at a centralized location, allowing individual monitoring devices to remain simple while still achieving reliable anomaly detection through their coordinated observations.
Data Source
AI summary
In one embodiment, a first device in a network identifies a first traffic flow between two endpoints that traverses the first device in a first direction. The first device receives information from a second device in the network regarding a second traffic flow between the two endpoints that traverses the second device in a second direction that is opposite that of the first direction. The first device merges characteristics of the first traffic flow captured by the first device with characteristics of the second traffic flow captured by the second device and included in the information received from the second device, to form an input feature set. The first device detects an anomaly in the network by analyzing the input feature set using a machine learning-based anomaly detector.