Dynamic Danger Rating Traffic Filtering for DDoS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting servers against DDoS attacks do not adequately address the issue of traffic filtering, leading to potential server overload and failure during distributed denial of service attacks.
Innovation Solution
A method and system for filtering network traffic that intercepts data from network nodes, determines data transmission parameters, assigns a danger rating, and applies filters to limit data transmission based on these parameters, thereby protecting servers from DDoS attacks by limiting data flow when the danger rating exceeds a threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traffic analysis and blocking methods are used to detect and prevent DDoS attacks, then server protection is improved, but traffic filtering effectiveness is insufficient leading to server overload
Solution Approach 1:
The system performs preliminary actions by intercepting data and determining transmission parameters before malicious traffic reaches the server. Danger ratings are assigned and filters are applied in advance, preventing overload rather than reacting to it. This proactive approach allows the system to prepare blocking mechanisms before the attack fully impacts the server.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring data transmission parameters, dynamically adjusting danger ratings based on observed traffic patterns, and refining filter effectiveness. The system learns from intercepted traffic and adapts its protection strategies, improving filtering precision while maintaining server protection.
2Measurement precision
If comprehensive traffic analysis is performed to detect DDoS attacks, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system segments the traffic analysis process into distinct functional modules: data interception, parameter determination, danger rating assignment, and filter application. Each module handles a specific aspect of the analysis, making the complex detection process more manageable and maintainable while preserving detection accuracy.
Solution Approach 2:
The system introduces an intermediary filtering layer between the network traffic and the server. This intermediary component performs comprehensive analysis without exposing the server's complexity, absorbing the computational burden of detailed traffic examination while presenting a simplified interface to the protected system.
3Reliability
If data transmission is limited based on danger ratings, then server protection is enhanced, but legitimate traffic may be blocked
Solution Approach 1:
The system dynamically changes the danger rating parameter based on observed transmission characteristics. By adjusting this parameter in real-time according to traffic patterns, the system can differentiate between legitimate and malicious traffic, protecting the server while allowing normal operations to continue with appropriate risk levels.
Data Source
Figure 1
Figure 2A~2B
Figure 3A
AI summary
Disclosed are a system (110), a method, and computer readable storage medium having instructions for filtering network traffic to protect a server from a distributed denial-of-service (DDoS) attack. The described technique includes intercepting data from a network node to the computing device (120) in response to detecting a computing device is subject to a DDoS attack. The technique further includes determining one or more data transmission parameters based on the intercepted data, assigning a danger rating to the network node, and changing the danger rating of the network node based on application of a filter and on the data transmission parameters (125). The described technique limits a transmittal of data from the network node to the computing device if the resultant danger rating of the network node exceeds a threshold value (130).