Cellular Security Slicing for Low-and-Slow DDoS Detection

The patent segments network traffic into different network slices based on security risk levels. High-risk traffic is isolated into separate slices for specialized analysis, while normal traffic continues on standard slices. This segmentation enables detailed inspection of low and slow attacks without blocking legitimate traffic, as each slice can be independently managed and analyzed for attack patterns.

The patent introduces network slices as intermediary structures between the user equipment and the core network. These slices act as mediators that can be configured with specific security policies, allowing traffic to be routed through controlled paths where low and slow attacks can be detected and analyzed before reaching the core network, enabling identification without immediate blocking.

The patent creates separate forensic network slices that are isolated from the main network. When devices are blocked for security events, their traffic is routed to these dedicated forensic slices where forensic analysis can be performed. This segmentation preserves forensic information by maintaining separate analysis channels that do not interfere with the blocking action, allowing both malicious traffic stopping and cause analysis to occur simultaneously.

The patent creates copies of network traffic and device states in isolated forensic slices. Instead of directly analyzing blocked devices in the main network, the system creates replicated traffic flows and device state information in separate forensic environments. This copying enables forensic analysis without affecting the blocking operation, as the copies can be examined in detail while the original malicious traffic is already blocked.

The patent segments security event handling into automated workflows that operate independently for each network slice. When security events are detected, the system automatically identifies affected slices and isolates them through predefined procedures. This segmentation reduces overall complexity by handling each slice independently through standardized automation, making the complex security response manageable and scalable across multiple slices.

The patent implements self-service automation where the network control system automatically detects security events, identifies affected network slices, and executes isolation procedures without manual intervention. The system monitors traffic patterns, detects anomalies, and autonomously manages slice isolation, reducing the operational complexity of security event handling while maintaining adaptability across different network configurations and external entities.