Slow HTTP DoS Detection in Backbone Networks Using Unidirectional Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to accurately and efficiently detect slow HTTP DoS (SHD) attacks in backbone networks due to high traffic volume, computational complexity, reliance on bidirectional traffic, and the prevalence of asymmetric routing, which complicates real-time detection and resource consumption.
Innovation Solution
A method involving an off-line training phase to extract unidirectional traffic features, use a custom Count-min Sketch structure for data storage, and apply a machine learning algorithm like random forest to detect SHD attacks in backbone networks, utilizing a public dataset and sampling at a rate of 1/n to minimize computational and storage overheads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If full bidirectional traffic data is used for detection, then detection accuracy is improved, but computational complexity and resource consumption increase significantly
Solution Approach 1:
The patent extracts only the necessary unidirectional traffic features from the complete bidirectional traffic data, focusing on packet length distribution, inter-arrival times, and flow patterns that are sufficient for SHD detection. This extraction approach maintains detection accuracy while significantly reducing the volume of data that requires complex computational processing.
Solution Approach 2:
The detection process is segmented into offline training phase and online detection phase. During offline training, complex feature engineering and model training are performed when computational resources are abundant. During online detection, only lightweight feature extraction and model inference are performed, reducing real-time computational complexity while preserving detection accuracy.
2Measurement precision
If detailed bidirectional flow data is observed and analyzed, then detection precision is improved, but the method becomes difficult to apply in high-traffic backbone networks
Solution Approach 1:
The patent applies partial action by selecting only the most discriminative unidirectional traffic features needed for SHD detection, rather than analyzing all available bidirectional flow data. This includes focusing on packet length distributions and timing patterns that are characteristic of slow HTTP attacks, while ignoring redundant information that would slow down processing in high-traffic environments.
3Reliability
If large numbers of features are selected for machine learning, then detection capability is improved, but computational amount increases and real-time detection becomes difficult
Solution Approach 1:
The patent performs feature selection and model training in advance during the offline training phase. Comprehensive feature analysis and model optimization are completed beforehand when computational time is not constrained. During online detection, the pre-trained model with selected features is applied directly, reducing real-time computational time while maintaining detection capability.
4Measurement precision
If bidirectional traffic data is used for detection, then detection accuracy is improved, but the method cannot handle asymmetric routing scenarios common in backbone networks
Solution Approach 1:
Instead of attempting to reconstruct bidirectional flow information from unidirectional data (which fails under asymmetric routing), the patent inverts the approach by directly designing unidirectional traffic features that are inherently suitable for single-directional observation. The feature extraction focuses on patterns visible in one direction of traffic flow, making the detection method naturally adaptable to asymmetric routing scenarios while maintaining effectiveness.
Data Source
AI summary
A method for detecting slow HTTP DoS (SHD) attacks in a backbone network can detect three different types of SHID attacks. The method is divided into an off-line training phase and an on-line detection phase. In the off-line training phase, several types of representative unidirectional traffic features are extracted according to attack characteristics of different SHD types and corresponding feature groups are built, where these features can effectively deal with a large amount of unidirectional traffic in backbone networks; a public backbone network dataset is systematically sampled and data are stored in combination with Count-min Sketch, which greatly minimizes storage and computational overhead required in the backbone networks; and a specific machine learning algorithm is used for training to obtain attack detection models. The method can be used for detecting and warning SHD attacks in mass traffic scenarios such as backbone networks to provide a basis for maintaining network security.