Cloud Defense Terminal DDoS Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for evaluating defense results against Distributed Denial of Service (DDoS) attacks are inaccurate due to imperfect evaluation methods, incomplete data traffic analysis, and lack of comprehensive parameters, leading to suboptimal defense strategies that either allow too much attack traffic or disrupt normal traffic.
Innovation Solution
A system and method that centralizes data traffic analysis by a defense terminal in a cloud platform, acquiring suspect and normal data traffic sets, host performance parameters, and calculating defense results using a target parameter set that includes access success rates and quality of network service to determine if the defense strategy meets expected Service-Level Agreement (SLA) levels, adjusting strategies accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the defense strategy is too strict to block DDoS attacks, then attack traffic is effectively blocked, but normal data traffic is affected and service availability decreases
Solution Approach 1:
The patent implements multiple defense strategies with different strictness levels (first, second, and third defense strategies) that can be dynamically selected based on attack detection results. The system changes parameters such as traffic filtering thresholds and cleaning intensity to balance attack blocking effectiveness with normal traffic throughput, rather than using a single fixed strict defense policy
Solution Approach 2:
The defense terminal dynamically adjusts its defense strategy based on real-time detection of attack traffic characteristics. The system transitions between different defense modes (normal defense, enhanced defense, emergency defense) according to the severity and type of detected attacks, allowing flexible adaptation rather than static strict filtering
2Productivity
If the defense strategy is too loose to allow normal traffic through, then service availability is maintained, but attack traffic penetrates and compromises target terminal security
Solution Approach 1:
The system performs preliminary detection and classification of traffic before applying defense strategies. By identifying suspect IP addresses and attack patterns in advance, the system can prepare appropriate defense measures without immediately applying strict filtering that would block normal traffic. The preliminary action enables differentiated treatment of attack versus normal traffic
Solution Approach 2:
The system continuously monitors the effectiveness of defense strategies and adjusts them based on feedback from traffic analysis results. When normal traffic is incorrectly blocked, the system learns and relaxes filtering rules. When attacks penetrate, the system tightens defense. This closed-loop feedback mechanism ensures both high normal traffic throughput and effective attack blocking
3Measurement precision
If comprehensive data traffic analysis is performed to improve defense result evaluation accuracy, then evaluation precision increases, but system complexity and processing time increase
Solution Approach 1:
The evaluation system is segmented into multiple independent modules: traffic acquisition module, suspect IP detection module, defense strategy execution module, and evaluation module. Each module handles a specific aspect of the analysis, allowing comprehensive evaluation without monolithic complexity. The segmentation enables parallel processing and independent optimization of each component
Solution Approach 2:
The patent introduces an evaluation module as an intermediary between the defense terminal and the management terminal. This intermediary aggregates complex evaluation data, processes it according to predefined metrics, and presents simplified results. The intermediary handles the complexity internally while providing clean, manageable outputs to users
Data Source
AI summary
A method including acquiring a suspect data traffic set, the suspect data traffic set including data traffic corresponding to each suspect IP address in a suspect IP address set included in original data traffic drawn by a defense terminal located in a cloud platform; acquiring normal data traffic, the normal data traffic being data traffic that remains after the defense terminal cleans the suspect data traffic set according to a preset defense strategy; acquiring host performance parameters, the host performance parameters being a set of parameters extracted from the target terminal after the defense terminal sends the normal data traffic to the target terminal; and quantifying a defense result based on a target parameter set, wherein the target parameter set at least includes: the suspect data traffic set, the normal data traffic and the host performance parameters. The defense result is accurate by comprehensively considering evaluation aspects and indexes.