DAG-Based DDoS Mitigation Chaining for Adaptive Packet Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDoS mitigation methods rely on static rule sets, which can be limiting and do not allow for dynamic reordering or additional conditions, making them less effective against evolving attack strategies.
Innovation Solution
A data processing system utilizing a directed acyclic graph (DAG) with inspector nodes that apply tags to data packets, allowing for dynamic and reconfigurable rule sets to mitigate DDoS attacks by determining the path and actions for each packet based on its content and tags.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If static rule sets are used for DDoS mitigation, then the system is simple to implement, but the system cannot adapt to evolving attack strategies
Solution Approach 1:
The patent transforms the static rule set into a dynamic system where rules can be automatically created, modified, and deleted based on real-time attack detection. The rule engine continuously adapts to new attack patterns by generating updated mitigation rules without requiring manual intervention, thus resolving the contradiction between adaptability and complexity.
Solution Approach 2:
The system implements self-service through automated rule generation and update mechanisms. When attacks are detected, the system automatically creates new mitigation rules and updates existing ones without human intervention. This self-updating capability enables continuous adaptation to evolving threats while maintaining operational simplicity.
2Reliability
If static mitigation rules are applied, then the processing speed is fast, but the effectiveness against new attack patterns is reduced
Solution Approach 1:
The system performs preliminary actions by pre-generating mitigation rules based on detected attack patterns. When new attacks are identified, the rule engine proactively creates update rules before the attacks can cause significant damage. This preliminary rule generation ensures continuous effectiveness without requiring time-consuming manual updates.
Solution Approach 2:
The patent ensures continuity of useful action through continuous monitoring and real-time rule updates. The system maintains an ongoing process of attack detection, rule generation, and deployment, ensuring that mitigation measures are continuously updated and effective against evolving threats without interruption or delay.
3Productivity
If manual rule updates are performed, then the system remains simple to manage, but the response time to new attacks is delayed
Solution Approach 1:
The system implements self-service through automated rule generation and update mechanisms. When attacks are detected, the system automatically creates new mitigation rules and updates existing ones without human intervention. This self-updating capability enables continuous adaptation to new threats while maintaining operational simplicity.
Solution Approach 2:
The patent introduces an automated rule engine as an intermediary between attack detection and mitigation deployment. This intermediary component handles the complex task of rule generation and updates, freeing operators from manual rule management while ensuring rapid response to new attacks. The rule engine mediates between security requirements and system operations.
Data Source
AI summary
A system includes instructions that cause processors to store a directed acyclic graph including nodes comprising selector nodes, mitigator nodes, and actor nodes, each of the nodes linked to another node, receive a data packet, inspect, using a selector node, a header of the data packet to determine a protection group, tag the data packet with an identification of the protection group based on the inspection, apply, using a mitigator node, criteria of a protection group policy corresponding to the protection group to the data packet based on the identification of the protection group tagged to the data packet, tag the data packet with a mitigation flag corresponding to a mitigation measure selected based on the application of the criteria of the protection group policy to the data packet, and apply, using an actor node, the mitigation measure corresponding to the mitigation tag to the data packet.