Bit Encoding Scheme for DDoS Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DDoS attack mitigation techniques are inadequate as they fail to accurately distinguish between legitimate and malicious traffic, do not allow for flexible policy configuration, and can degrade system performance, making them ineffective in handling high-rate attacks and overloading scenarios.
Innovation Solution
A method using a bit encoding scheme for network traffic analysis, which performs frequency analysis on packet fields, selects top values, assigns variable bit encoding, and applies bitwise operations to detect anomalies, allowing for real-time filtering and mitigation without degrading system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard mitigation tactics discard all packets destined to victim server, then attack traffic is blocked, but legitimate traffic is also blocked and system performance degrades
Solution Approach 1:
The patent segments the traffic analysis process into distinct phases: encoding packets into compact representations, maintaining separate state information for different traffic patterns, and processing packets through multiple analysis stages. This segmentation allows the system to handle attack mitigation and legitimate traffic processing separately, preventing degradation of overall system performance while maintaining effective attack blocking.
Solution Approach 2:
The patent introduces an intermediary encoding scheme that transforms packet data into compact bitfield representations before analysis. This intermediary representation layer enables efficient comparison and pattern matching without requiring full packet inspection, thus maintaining mitigation effectiveness while reducing processing overhead and preserving system performance.
2Measurement precision
If frequency analysis is performed on all packet fields, then detection accuracy improves, but processing time increases
Solution Approach 1:
The patent extracts only the most relevant packet fields for frequency analysis by encoding packets into bitfield representations that highlight significant characteristics. This extraction approach maintains detection accuracy by focusing on key identifying features while reducing processing time by eliminating analysis of less relevant data.
Solution Approach 2:
The patent changes the parameter representation of packet data by transforming raw packet fields into encoded bitfield values. This parameter transformation enables more efficient frequency analysis and pattern matching, improving detection accuracy while reducing the computational time required for processing large volumes of traffic.
3Productivity
If variable bit encoding is used to compress packet data, then processing efficiency improves, but encoding complexity increases
Solution Approach 1:
The patent employs dynamic bitfield encoding where the number of bits allocated to each packet field varies based on the field's characteristics and importance. This dynamic encoding approach improves processing efficiency by using fewer bits for less critical fields while maintaining accuracy for important fields. The encoding complexity is managed through systematic rules that adapt to different packet types and attack patterns.
Data Source
AI summary
A method of detecting patterns in network traffic is provided. The method includes receiving packets of network traffic, performing a frequency analysis per field of the packets as a function of frequency of the occurrence of the same data in the corresponding field, and selecting top values which are values associated with each field of the set of fields that satisfy a criterion as having occurred most frequently in the packets as a function of a result of the frequency analysis. The method further includes assigning a bit encoding scheme that uses variable bit encoding to encode each of the top values for each field that has a top value, encoding into a single value each packet of the packets based on a bitfield representation that uses the encoding scheme for values associated with each field that has a top value, storing each potential combination of fields of the set of fields being processed, with all bits set per field when the field is an active field and no bits set when the field is inactive, performing a bitwise operation on each encoded packet with the stored potential combinations, sorting the results of the bitwise operation based on a number of the active fields and a number of occurrences of each same result of the bitwise operation, and providing the results of the sorting to a mitigation device for determining whether an attack is underway and/or for filtering network traffic for mitigating an attack.