Cohort-Based DDoS Detection Using Device Fingerprints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting and mitigating application layer Distributed Denial of Service (DDoS) attacks is challenging due to their complexity and the difficulty in identifying malicious clients, especially when they involve large botnets, leading to increased downtime.
Innovation Solution
Utilizing cohort analysis to identify one malicious client, extract its characteristics and attack patterns, and apply these to detect and block similar clients, employing a system with a data processing unit that monitors network traffic and applies mitigation measures such as blocking or rate-limiting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If traditional DDoS attack detection methods are used, then detection accuracy may be maintained, but detection time increases and downtime increases
Solution Approach 1:
The system performs preliminary actions by establishing baseline traffic patterns and identifying cohorts of similar traffic sources before attacks occur. By pre-characterizing normal traffic behavior and grouping similar sources, the system is already prepared to quickly identify anomalies when attacks start, reducing detection time without sacrificing accuracy.
Solution Approach 2:
The system creates copies of traffic patterns by generating synthetic representations of attack traffic based on identified cohorts. These copied patterns allow for rapid comparison and matching during attacks, enabling fast detection while maintaining the ability to accurately distinguish attack traffic from legitimate traffic.
2Measurement precision
If comprehensive analysis of each client is performed, then detection accuracy improves, but system complexity and processing time increase
Solution Approach 1:
The system merges analysis by grouping individual clients into cohorts based on similar traffic characteristics, geographic locations, or behavioral patterns. Instead of analyzing each client independently, the system analyzes cohorts collectively, reducing computational complexity while maintaining detection precision through the aggregated behavioral patterns of multiple clients.
Solution Approach 2:
The system implements universal analysis methods that can be applied across all clients and attack types. By creating a unified framework for traffic analysis that works across different attack scenarios and client types, the system reduces overall complexity while maintaining consistent detection precision throughout the network.
3Productivity
If traditional detection methods are used, then false positive rates may be controlled, but detection speed decreases leading to increased downtime
Solution Approach 1:
The system skips detailed analysis of obviously malicious traffic by using rapid cohort-based filtering. When traffic patterns match known attack cohorts, the system quickly identifies and blocks these threats without performing exhaustive analysis, rushing through the detection process for high-confidence cases while maintaining controlled false positive rates through established baseline comparisons.
Data Source
AI summary
A network monitoring device is connected to a communications network and monitors traffic transmitted to and from a server. The system stores a device fingerprint of devices identified as involved in attacks across the communications network, generates attack patterns for attacks across the communications network based on data packets transmitted or received by the devices during an attack based on the data packets corresponding to the device fingerprint, monitors data packet exchanges between the server and network devices, determines a set of transmission parameters for each of the data packet exchanges, compares the set of transmission parameters for the plurality of data packet exchanges to the attack patterns, and, responsive to determining a match between a first set of transmission parameters and an attack pattern, applies a tag to a network device communicating with the server via the data packet exchange indicating the network device is involved in an attack.