Datacenter Flow Aggregation for Carpet Bombing DDoS Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network analytical techniques struggle to detect volumetric DDoS 'carpet bombing' attacks, which saturate datacenter network switches by transmitting limited malicious packet data to multiple servers within a subnet, making detection difficult.
Innovation Solution
A multi-layered aggregation processing architecture that iteratively analyzes network flow information to detect potential threats by assigning time, datacenter, subnet, and server thresholds, issuing alerts when packet data size or number exceeds predefined limits, and accommodating future IP address aggregation for failover protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional network analytical techniques are used to monitor network traffic, then detection of traditional DDoS attacks targeting specific hosts is effective, but detection of volumetric carpet bombing attacks saturating network switches is difficult
Solution Approach 1:
The patent segments the detection approach by creating multiple aggregation layers (time aggregation, datacenter aggregation, subnet aggregation, server aggregation) that divide the monitoring task into hierarchical components. Each layer processes network flow information at a different granularity level, enabling detection of both traditional host-targeted attacks and volumetric carpet bombing attacks that saturate network switches.
Solution Approach 2:
The patent adds temporal and hierarchical dimensions to the detection process by implementing time aggregation windows and multi-layer aggregation structures. This transforms the detection from a single-dimension host-level analysis to a multi-dimensional approach that considers time intervals, datacenter levels, subnet ranges, and individual server levels simultaneously.
2Reliability
If network flow information is aggregated across multiple servers and subnets, then detection of volumetric attacks is improved, but processing complexity increases
Solution Approach 1:
The processing architecture is segmented into distinct aggregation layers, each handling specific aspects of network flow analysis. The time aggregation layer handles temporal grouping, the datacenter aggregation layer handles geographic/organizational grouping, the subnet aggregation layer handles network segment grouping, and the server aggregation layer handles individual host analysis. This segmentation distributes processing complexity across manageable modules.
Solution Approach 2:
The aggregation processing is designed to be dynamic and adaptive. The system can adjust aggregation parameters such as time window sizes, threshold values, and aggregation levels based on network conditions and attack patterns. This dynamic approach allows the system to maintain detection accuracy while adapting processing complexity to current network states.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method and system for detecting volumetric malicious threats by iteratively aggregating network flow information of received packet data is presented that includes: analyzing the network flow information of the received packet data; assigning a time interval window, based on the network flow information for time aggregation; determining a corresponding datacenter (DC), based on the network flow destination IP information for DC aggregation; determining a corresponding subnet IP range, based on the network flow destination IP information for subnet aggregation; and determining a transport protocol for corresponding servers of the IP subnet. The packet data size and/or number of packets for the subnet transport protocol and the server transport protocol are updated based on the received packet data. And upon detection that the subnet or server transport protocol updated packet size/number of packets exceed predefined thresholds, issue alerts indicating a potential volumetric malicious threat.