CRT-RS Network Traffic Analysis for DDoS Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting Distributed Denial of Service (DDoS) flooding attacks face challenges with large-scale network traffic, requiring effective compression and fusion of network data, and lack self-adaptive and protocol-independent detection capabilities, leading to inefficiencies and high false alarm rates.
Innovation Solution
A Chinese Remainder Theorem based Reversible Sketch (CRT-RS) is designed to compress and fuse network traffic, combined with a Modified Multi-chart Cumulative Sum (MM-CUSUM) algorithm for multidimensional change-point detection, enabling the system to handle large-scale traffic, adapt to changes, and detect attacks across various protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods are used for DDoS flooding attacks, then detection capability is provided, but detection accuracy and efficiency deteriorate due to large-scale network traffic
Solution Approach 1:
The patent segments network traffic into multiple dimensions (protocol type, packet size, source address, destination address, time interval) and creates separate statistical models for each dimension. This segmentation allows the system to handle large-scale traffic by processing individual dimensions independently, improving both detection accuracy through detailed analysis and efficiency through parallel processing of segmented data.
Solution Approach 2:
The patent introduces multi-dimensional analysis by examining traffic characteristics across multiple dimensions simultaneously (protocol distribution, packet size distribution, source/destination address distribution, temporal patterns). This dimensional expansion transforms the detection approach from single-metric to multi-metric analysis, enhancing detection accuracy while maintaining efficiency through structured dimensional processing.
2Productivity
If network traffic collection is incomplete or processing is non-real-time, then processing load is reduced, but detection accuracy deteriorates
Solution Approach 1:
The patent implements preliminary action by pre-defining multiple traffic dimension categories (protocol type, packet size ranges, address formats, time intervals) and preparing statistical models in advance. During real-time processing, traffic data is directly mapped to these pre-defined dimensions and models, eliminating the need for complex runtime analysis while maintaining complete and accurate traffic collection across all dimensions.
Solution Approach 2:
The patent ensures continuous real-time processing by implementing streaming analysis that continuously collects and analyzes traffic data across all dimensions without interruption. The system maintains continuous statistical updates for each dimension, ensuring that detection accuracy is preserved through uninterrupted monitoring while processing efficiency is maintained through continuous incremental updates rather than batch processing.
3Adaptability or versatility
If static detection models are used, then implementation simplicity is maintained, but adaptability to changing attack patterns deteriorates
Solution Approach 1:
The patent implements dynamic detection models that automatically adapt to changing attack patterns through continuous statistical analysis. The system dynamically updates traffic distribution statistics across all dimensions in real-time, allowing detection thresholds and models to evolve with emerging attack patterns. This dynamic adaptation enhances versatility while managing complexity through automated statistical computation rather than manual model configuration.
Solution Approach 2:
The patent utilizes parameter changes by continuously monitoring and updating statistical parameters (mean, standard deviation, distribution patterns) for each traffic dimension. When attack patterns change, the system automatically adjusts detection parameters based on updated statistics, enabling adaptability to new threats. This parameter-driven approach achieves versatility through automatic parameter adjustment while keeping model complexity manageable through standardized statistical methods.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A method, device, and system for network traffic analysis are provided. The method comprises obtaining traffic data of current time interval, recording the traffic data in a Chinese Remainder Theorem based Reversible Sketch (CRT-RS) based on a hash operation comprising Modulo operations, detecting abnormal buckets in the CRT-RS based on a change between the traffic data of current time interval and traffic data of previous time interval, and recovering abnormal source address associated information based on the abnormal buckets, wherein the modulus of the Modulo operations are selected from the modulus in Chinese Remainder Theorem (CRT) as pairwise coprime integers and the CRT-RS includes a plurality of buckets. The step of detecting uses a Modified Multi-chart Cumulative Sum.