DDoS Blocklist Forgiveness Using Behavior-Based Reclassification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDoS attack mitigation systems incorrectly identify legitimate users as malicious attackers, leading to false positives and blocking their access to network resources, which can harm user experience and increase vulnerability to attacks.
Innovation Solution
A system that employs human behavior analysis (HBA) to classify requests as legitimate or malicious, using observation cycles to store and analyze request data across cycles, allowing forgiveness for temporary misclassifications by reconciling good and bad address lists and using infraction counters to automate the removal of false positives from block lists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If requests are blocked based on classification as bad requests, then DDoS attack mitigation is improved, but false positives increase causing legitimate users to be blocked
Solution Approach 1:
The system performs preliminary classification of requests as good or bad within observation cycles before final blocking decisions are made. This preliminary action allows the system to identify potentially malicious requests early while maintaining the ability to review and correct classifications before permanent blocking occurs, thereby reducing false positives while maintaining DDoS mitigation effectiveness
Solution Approach 2:
The system uses infraction counters that track and accumulate bad request classifications over multiple observation cycles. This feedback mechanism allows the system to distinguish between temporary anomalies and sustained malicious behavior, blocking only those addresses with consistently high infraction counts, thereby reducing false positives from transient issues while maintaining reliable DDoS mitigation
2Reliability
If blacklisting is used to block malicious traffic, then website availability is protected, but legitimate users may be erroneously blocked and difficult to identify
Solution Approach 1:
The system replaces manual blacklisting operations with automated classification and management mechanisms. Good address lists are automatically generated and maintained, and the reconciliation process between good and bad lists is performed automatically, eliminating the need for manual identification and removal of legitimate users from blocklists while maintaining website availability protection
Solution Approach 2:
The system performs self-correction by automatically reconciling good and bad address lists and removing false positives without external intervention. The infraction counter system automatically identifies addresses that consistently exhibit malicious behavior versus those with transient issues, enabling the system to self-manage the blocklist and reduce false positives without requiring manual operation
3Measurement precision
If observation cycles are used to store and analyze request data, then false positives can be reduced through reconciliation, but system complexity increases
Solution Approach 1:
The system segments the address management process into distinct good address lists and bad address lists, each maintained separately within observation cycles. This segmentation allows for independent analysis and reconciliation of the two lists, improving classification precision while organizing system complexity into manageable, distinct components rather than a monolithic complex system
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are provided for blocking forgiveness in a system that mitigates distributed denial of service (DDoS) attacks on a network. A user's network address can be blocked as a result performing human behavior analysis on network resource request activity from the user's address. The system can block an address temporarily based on their behavior, classifying legitimate human users as a malicious attacker performing a DDoS attack. But subsequent behavioral analysis of network resource requests can identify that the user should not have been blocked. The system can automatically unblock the user's address, and allow further network resource requests. Previously blocked requests can also be unblocked. The number of infractions (e.g., action classified as malicious) can be tracked and compared to a threshold. If the number is less than the threshold, then that address is not blocked, thereby allowing forgiveness of a certain number of infractions.