Attack-Safe Baseline Learning for Application Layer Flood Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current systems face challenges in accurately learning baselines for detecting HTTP and HTTPS flood attacks due to contamination of initial learning periods with attacker traffic, leading to difficulties in distinguishing between legitimate and malicious traffic, and the risk of false positives or false negatives in attack detection.

Innovation Solution

A system that measures rate-based and rate-invariant attributes from application-layer transactions to determine normal behavior, computes and validates baselines, allowing for the differentiation between legitimate and malicious traffic, and continuously updates these baselines during active attacks to ensure accurate detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the detection system allows a learning period to establish baselines, then accurate attack detection becomes possible, but the learning period is contaminated with attacker traffic making accurate detection difficult

Engineering Contradiction:

Improveaccuracy of attack detectionVSAvoidcontamination of learning period with attacker traffic

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary actions during the learning period by continuously monitoring traffic patterns and using anomaly detection to identify and filter out attacker traffic before it can contaminate the baseline. This preliminary filtering ensures that only legitimate traffic is used to establish accurate baselines, resolving the contradiction between allowing learning time and preventing contamination.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where detected anomalies during the learning period are fed back into the system to adjust the baseline establishment process. This feedback loop allows the system to iteratively refine its baseline learning, excluding contaminated data points and improving the accuracy of the final baseline without requiring a contamination-free learning period.

Inventive Principle:

Principle #23Feedback

2Adaptability or versatility

If the detection system operates during active attacks to continuously update baselines, then adaptation to current attack patterns is improved, but false positives and false negatives increase

Engineering Contradiction:

Improveability to detect current attack patternsVSAvoidfalse positives and false negatives in detection

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system applies local quality by treating different traffic characteristics differently during baseline updates. Instead of uniformly accepting all traffic during active attacks, the system analyzes specific local features (such as request patterns, response times, and protocol behavior) to determine whether to incorporate each data point into the baseline. This selective incorporation maintains adaptability while filtering out false anomalies.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system changes parameters dynamically based on the operational context. During active attacks, the system adjusts baseline update parameters (such as weighting factors, threshold values, and convergence criteria) to balance adaptability with accuracy. These parameter changes allow the system to learn from current attack patterns while maintaining sufficient reliability to avoid false positives and negatives.

Inventive Principle:

Principle #35Parameter changes

3Measurement precision

If the system requires a contamination-free learning period, then baseline accuracy is improved, but the time to become operational is extended

Engineering Contradiction:

Improveaccuracy of baseline representationVSAvoidlearning period duration before operational readiness

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system enables continuity of useful action by performing baseline learning and anomaly detection simultaneously during the operational period. Instead of requiring a separate contamination-free learning phase followed by operational mode, the system continuously learns from incoming traffic while filtering out anomalies, allowing baseline establishment and attack detection to proceed in parallel without extending the time to operational readiness.

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

The system introduces an intermediary anomaly detection module that acts as a mediator between the traffic flow and the baseline learning process. This intermediary continuously analyzes incoming traffic, identifies potential anomalies, and selectively filters them out during baseline updates. This mediation allows the system to learn from traffic during operational periods while maintaining baseline accuracy, eliminating the need for extended contamination-free learning periods.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20240169061A1Techniques for accurate learning of baselines for the detection of advanced application layer flood attack tools

Publication Date: 2024.05.23 RADWARE LTD

AI summary

A system and method for learning attack-safe baseline are provided. The method includes receiving application-layer transactions directed to a protected entity; measuring values of a rate-based attribute and a rate-invariant attribute from the received application-layer transactions; determining, based on the measured rate-based attribute, if the received application-layer transactions represent a normal behavior; computing at least one baseline using application-layer transactions determined to represent the normal behavior; and validating the at least one computed baseline using the measured rate-invariant attribute and rate-based attribute.