Botnet Source Segmentation for Targeted Traffic Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques fail to effectively identify and protect against botnets, as they require geographic dispersal of participants, making it challenging to filter malicious traffic without impacting legitimate users and often leading to over-blocking or under-blocking during distributed denial-of-service (DDoS) attacks.
Innovation Solution
A system that identifies botnet members by analyzing incoming traffic for behavior similarity over time, using a traffic monitoring module and botnet identification module to determine sets of botnet sources, allowing for targeted protection measures to be activated only for malicious traffic, thereby minimizing disruption to non-malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all traffic is blocked during a botnet attack, then the service is protected from malicious requests, but legitimate user traffic is also disrupted and service quality deteriorates
Solution Approach 1:
The patent segments traffic filtering from a global all-or-nothing approach to a granular per-source approach. Instead of blocking all traffic from botnet sources collectively, the system evaluates and filters individual source IPs independently, allowing legitimate traffic from some sources to pass while blocking malicious traffic from other sources. This segmentation resolves the contradiction by enabling selective protection without blanket service disruption.
Solution Approach 2:
The patent applies local quality by treating each traffic source with differentiated filtering quality based on its maliciousness assessment. Rather than uniform blocking or allowing of all botnet traffic, the system applies high-filtering quality to malicious sources and low or zero filtering quality to legitimate sources. This localized differentiation enables the service to maintain high availability for legitimate users while achieving reliable protection against actual threats.
2Productivity
If all traffic is allowed during a botnet attack, then service availability is maintained, but the service becomes vulnerable to overload from malicious requests
Solution Approach 1:
The system segments the botnet source group into individual evaluable units, allowing the service to maintain availability by processing traffic from each source independently. Legitimate sources continue uninterrupted while malicious sources are selectively blocked, thus maintaining overall service availability while providing protection against malicious overload.
Solution Approach 2:
The patent applies partial action by implementing filtering only where necessary (for malicious sources) rather than applying excessive blanket filtering to all botnet sources. This partial filtering approach maintains service availability for the majority of legitimate traffic while providing sufficient protection against malicious requests to prevent service overload.
3Reliability
If filtering mechanisms are applied to botnet traffic, then malicious requests are blocked, but the geographic dispersal of botnets makes identification and filtering difficult
Solution Approach 1:
The patent breaks down the complex problem of botnet traffic filtering by segmenting it into independent per-source evaluation units. Instead of attempting to filter botnet traffic as a collective group (which is complex due to geographic dispersal), the system analyzes and filters each source IP independently using consistent criteria, significantly reducing the complexity of identification and filtering.
Solution Approach 2:
The system enables self-service by allowing each traffic source to be evaluated and filtered based on its own characteristics and behavior patterns. Each source essentially judges itself through the evaluation criteria, with the system automatically identifying malicious sources through their traffic patterns without requiring complex manual identification or grouping of geographically dispersed botnet members.
Data Source
AI summary
A botnet identification module identifies members of one or more botnets based upon network traffic destined to one or more servers over time, and provides sets of botnet sources to a traffic monitoring module. Each set of botnet sources includes a plurality of source identifiers of end stations acting as part of a corresponding botnet. A traffic monitoring module receives the sets of botnet sources from the botnet identification module, and upon a receipt of traffic identified as malicious that was sent by a source identified within one of the sets of botnet sources, activates a protection mechanism with regard to all traffic from all of the sources identified by the one of the sets of botnet sources for an amount of time.