Stateful Connection Manager Resource Protection via Packet Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Stateful network connection managers, such as firewalls and web servers, face resource exhaustion attacks that overwhelm their memory resources, making it difficult to differentiate between malicious and legitimate traffic, leading to performance degradation and service denial.
Innovation Solution
A system that analyzes data packet headers for source IP addresses and Time to Live values to determine the probability of an attack, using reputation scores, packet frequency, and resource occupancy to decide whether to allocate or deny resources for processing, thereby penalizing suspicious packets without significantly impacting legitimate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If stateful connection managers allocate resources to track all connections, then connection tracking accuracy is improved, but resource exhaustion vulnerability increases
Solution Approach 1:
The system changes the parameter of resource allocation from binary (allocate/deny) to probabilistic (allocate with probability p). The connection manager calculates a probability p based on packet characteristics and resource occupancy, then allocates resources accordingly. This resolves the contradiction by allowing the system to maintain accurate tracking for legitimate connections while probabilistically denying resources to attack traffic, thus reducing resource exhaustion vulnerability without sacrificing tracking accuracy.
Solution Approach 2:
The system dynamically adjusts resource allocation policies based on real-time conditions. The probability threshold and allocation decisions are dynamically modified based on current resource occupancy levels and packet analysis results. This dynamic approach allows the system to adapt to changing attack patterns and maintain optimal balance between tracking accuracy and resource protection.
2Measurement precision
If the connection manager uses advanced packet analysis to identify attacks, then attack detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-defining packet characteristics and thresholds for attack detection. Instead of conducting complex real-time analysis, the connection manager compares incoming packets against pre-established criteria (such as unusual packet sizes, invalid headers, or patterns matching known attack signatures). This preliminary preparation enables accurate attack detection without the time cost of complex real-time analysis.
Solution Approach 2:
The system skips unnecessary analysis steps for packets that clearly match attack patterns or fail basic validation checks. By rapidly rejecting obviously malicious packets through simple checks, the system reduces processing time for attack traffic while maintaining accurate detection. Legitimate packets that pass initial filters undergo more thorough analysis only when necessary.
Data Source
AI summary
A computing system and related method protect a computer network connection manager's resources from attempted resource attacks by extracting SrcIP and TTL values from received data packet headers. Extracted SrcIP and TTL values are analyzed to determine the probability that a received data packet is malicious. If the probability exceeds a specified threshold, resources are denied, and the packet is dropped. If the specified threshold is not exceeded, resources are allocated to the received data packet. The SrcIP reputation score, TTL value frequency, SrcIP frequency, SrcIP geo-location, and resource occupancy may all be used in computing the probability of a malicious data packet. These factors may be weighted and summed to calculate the probability of a malicious data packet.