DDoS Cleaning Device TCP Session State Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DDoS attack mitigation methods, such as bypass cleaning, often result in the discarding of ACK messages during TCP flag-based attacks, affecting normal services due to the inability of cleaning devices to validate outgoing messages using the TCP protocol stack state.
Innovation Solution
A method and apparatus that maintain a simple TCP session by establishing a session upon receiving a SYN message, discard messages without a corresponding session, and manage session timeouts to differentiate between legitimate and malicious traffic, ensuring normal ACK messages are retained and attacks are effectively filtered.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If speed limitation is used to resist DDoS attacks, then attack traffic is filtered, but normal ACK messages are discarded affecting service quality
Solution Approach 1:
The cleaning device performs preliminary actions by establishing TCP sessions in advance and maintaining session state information before actual data transmission. This allows the device to proactively identify and filter malicious packets based on session validity, rather than reactively discarding packets based on speed limits alone.
Solution Approach 2:
The invention implements feedback mechanisms by continuously monitoring TCP session states and using this information to dynamically adjust packet filtering decisions. The device receives feedback from TCP handshake processes and uses this feedback to determine whether incoming packets belong to legitimate sessions, thereby preserving normal services while blocking attacks.
2Reliability
If bypass cleaning is used to divert attack traffic, then attack traffic is redirected to cleaning device, but cleaning device cannot see outgoing messages limiting its ability to validate traffic
Solution Approach 1:
The invention adds another dimension to traffic validation by introducing TCP session state tracking. Instead of only analyzing incoming packets in isolation, the device validates packets against maintained session states, creating a multi-dimensional validation approach that enables effective filtering while preserving legitimate traffic.
Solution Approach 2:
The TCP session state acts as an intermediary that bridges the gap between incoming and outgoing traffic. By maintaining session information as intermediate data, the cleaning device can indirectly validate outgoing messages that it cannot directly observe, using the session state as a mediator to infer the legitimacy of traffic.
3Reliability
If TCP session state is maintained for traffic validation, then message validity can be determined, but device complexity increases
Solution Approach 1:
The invention applies local quality by maintaining session state information selectively for specific TCP connections rather than globally for all traffic. This localized approach to session management reduces overall complexity by only tracking states where needed, while still enabling effective validity determination for relevant packets.
Solution Approach 2:
The device manages complexity through parameter changes by dynamically adjusting session timeout values and validation thresholds. By changing temporal parameters such as session expiration times and packet interval thresholds, the system can adapt its complexity level based on traffic patterns while maintaining reliability.
Data Source
AI summary
Embodiments of the present disclosure relate to a method and apparatus for processing data. The method can include: receiving a SYN message with a destination address being a target IP; establishing a session based on a quadruple of the SYN message; and forwarding the SYN message to a server corresponding to the target IP.