DDoS Baseline Learning via Rate-Based and Invariant Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions fail to accurately and efficiently characterize HTTP flood attacks, as they struggle to differentiate between legitimate and malicious requests, especially with advanced attack tools generating 'legitimate-like' requests that evade existing mitigation mechanisms, leading to high false positive and false negative rates.
Innovation Solution
A system that measures rate-based and rate-invariant attributes from application-layer transactions to determine normal behavior, computes and validates baselines, and builds a set of baselines for characterizing DDoS attacks, using paraphrase vectors and buffers to generate dynamic signatures for efficient mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing mitigation mechanisms are used to filter HTTP requests, then some attack traffic can be blocked, but legitimate traffic is incorrectly identified as malicious (high false positive rate)
Solution Approach 1:
The patent segments the analysis of HTTP requests into multiple independent components: rate-based attributes (requests per second, requests per minute) and rate-invariant attributes (paraphrase vectors containing URL, method, header information). By analyzing these segmented components separately and combining their results, the system achieves more accurate detection with fewer false positives compared to holistic analysis approaches.
Solution Approach 2:
The patent transforms the detection approach by changing parameters from analyzing raw HTTP request content to analyzing derived features: rate-based parameters (temporal patterns) and rate-invariant parameters (structural patterns via paraphrase vectors). This parameter transformation enables the system to distinguish attack patterns from legitimate traffic more effectively, reducing false positives while maintaining detection accuracy.
2Reliability
If existing mitigation mechanisms are used to filter HTTP requests, then some attack traffic can be blocked, but attack traffic is incorrectly identified as legitimate (high false negative rate)
Solution Approach 1:
By segmenting analysis into rate-based and rate-invariant components, the system ensures that attacks are detected through multiple independent indicators. Attack traffic typically exhibits abnormal patterns in both rate-based metrics (unusual request frequencies) and rate-invariant metrics (suspicious paraphrase patterns), making it difficult for attackers to evade detection while reducing false negatives.
Solution Approach 2:
The patent introduces paraphrase vectors as intermediary representations that capture essential structural features of HTTP requests without exposing sensitive content. These vectors serve as mediators between raw request data and detection algorithms, enabling sophisticated pattern recognition while maintaining efficiency and accuracy in identifying malicious traffic.
3Object-affected harmful factors
If sophisticated attack tools generating 'legitimate-like' requests are used, then attack effectiveness increases, but detection accuracy decreases
Solution Approach 1:
The patent implements dynamic analysis by continuously monitoring rate-based attributes over time windows and adapting detection thresholds based on observed traffic patterns. This dynamic approach allows the system to detect sophisticated attacks that mimic legitimate traffic by identifying subtle temporal anomalies and evolving patterns that static rules would miss, maintaining detection accuracy against advanced attack tools.
Solution Approach 2:
The system transforms sophisticated attack detection by changing from content-based analysis to structural and temporal pattern analysis using paraphrase vectors and rate metrics. This parameter change enables the detection of attacks that use legitimate-looking content by focusing on structural anomalies and temporal patterns that are difficult for attackers to replicate without detection.
4Ease of manufacture
If simple mitigation solutions are used, then implementation is easier, but accuracy in characterizing attacks decreases
Solution Approach 1:
The patent achieves a balance between simplicity and accuracy by segmenting the detection system into independent, modular components: rate-based analysis module and rate-invariant analysis module. Each module can be implemented and tuned separately, simplifying deployment while maintaining high detection accuracy through the combined analysis of multiple attack dimensions.
Data Source
AI summary
A system and method for learning attack-safe baselines are provided. The method includes receiving application-layer transactions directed to a protected entity; measuring values of a rate-based attribute and a rate-invariant attribute from the received application-layer transactions; determining, based on the measured rate-based attribute, if the received application-layer transactions represent a normal behavior; computing at least one baseline using application-layer transactions determined to represent the normal behavior; validating the at least one computed baseline using the measured rate-invariant attribute and rate-based attribute; and building a set of baselines based on the at least one validated baseline, wherein the set of baselines are utilized for characterization of DDoS attacks.