Connection-Rate Filtering via Packet Sampling and Metering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virus throttling methods require layer 3 routing and virtual local area networking, which can be complex and unnecessary for effective connection-rate filtering, and do not efficiently manage traffic without relying on virus signatures.
Innovation Solution
Implementing connection-rate filtering through metering and sampling circuitry in network devices to measure and compare traffic rates, sample packets, and analyze distinct destinations, allowing for the identification of potentially malicious behavior without the need for layer 3 routing or route tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If layer 3 routing and virtual local area networking are used for virus throttling, then connection-rate filtering capability is improved, but device complexity and configuration difficulty increase
Solution Approach 1:
The patent segments the connection-rate filtering function from the layer 3 routing function. The switch hardware performs simple layer 2 packet forwarding and basic metering, while the host running the agent program performs the complex analysis and filtering decisions. This segmentation allows effective virus throttling without requiring the switch to implement complex layer 3 routing and virtual LAN configurations.
Solution Approach 2:
The patent introduces an intermediary agent program running on the host that acts as a mediator between the network switch and the filtering logic. The agent receives sampled packets from the switch, performs destination analysis, and sends control messages back to the switch. This intermediary approach eliminates the need for complex switch configuration while maintaining effective connection-rate filtering.
2Measurement precision
If all packets are analyzed in real-time, then detection accuracy is improved, but network performance and processing overhead deteriorate
Solution Approach 1:
The patent applies partial action by sampling only a subset of packets for analysis rather than examining every packet. The switch meters traffic rates and selectively samples packets based on threshold exceedances, sending only relevant sampled packets to the agent program for analysis. This approach maintains detection accuracy for malicious traffic while significantly reducing processing overhead and preserving network throughput.
Solution Approach 2:
The system implements feedback through the agent program that analyzes sampled packets and sends control messages back to the switch when malicious patterns are detected. The switch uses this feedback to adjust sampling rates or block specific traffic flows. This feedback mechanism ensures accurate detection while maintaining efficient network performance by only intensifying analysis when necessary.
3Measurement precision
If traffic sampling rate is increased, then detection accuracy is improved, but network overhead and processing load increase
Solution Approach 1:
The patent implements dynamic sampling where the sampling rate adjusts based on traffic conditions and detected threats. The switch meters traffic rates and increases sampling when thresholds are exceeded, while reducing sampling during normal conditions. The agent program dynamically analyzes sampled packets and adjusts analysis depth based on detected patterns. This dynamic approach optimizes detection accuracy while minimizing unnecessary processing overhead.
Data Source
AI summary
One embodiment disclosed relates to a method of connection-rate filtering. A rate of traffic through a port of a network device is measured. The measured traffic rate is compared with a pre-set threshold rate. Packets are sampled from the port over a period of time if the pre-set threshold rate is exceeded by the measured traffic rate, and the sampled packets are analyzed. Other embodiments are also disclosed.