DDoS Defense via Parameter Ranking and ML Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DDoS defense systems in packet-switched networks face challenges in real-time detection and differentiation between DDoS attacks and flash crowds, particularly in on-demand media platforms like IPTV, due to high computational overhead, lack of labeled data for machine learning, and complexity in handling multi-variate time-series data, which affects their effectiveness and efficiency.
Innovation Solution
A probabilistic rule-based DDoS defense system that ranks significant network parameters, uses machine learning to build models from history data and external media data, and differentiates between DDoS attacks and flash crowds by analyzing network traffic patterns and social media data, allowing for adaptive and flexible real-time detection with reduced computational overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional DDoS defense systems analyze all network parameters in real-time, then detection accuracy improves, but computational overhead increases significantly
Solution Approach 1:
The patent extracts and selects only the most relevant network parameters from the complete set of available parameters. A parameter selection module identifies and extracts key parameters (such as packet rate, flow duration, protocol distribution) that are most indicative of DDoS attacks, discarding less relevant parameters to reduce computational overhead while maintaining detection accuracy.
Solution Approach 2:
The patent applies different analysis depths to different parameters based on their relevance. High-priority parameters undergo detailed analysis with multiple features and machine learning models, while lower-priority parameters receive simpler processing. This localized quality approach optimizes computational resources by concentrating processing power where it provides the most value for detection accuracy.
2Reliability
If machine learning models are trained with comprehensive network parameters, then detection reliability improves, but model complexity and training time increase
Solution Approach 1:
The patent performs preliminary parameter selection and feature engineering before model training. By pre-identifying the most relevant parameters and engineering appropriate features from these parameters, the system reduces the dimensionality of the training data. This preliminary action simplifies the model training process and reduces model complexity while maintaining detection reliability through focused training on the most discriminative features.
3Measurement precision
If the system monitors all network traffic parameters, then detection coverage improves, but processing speed decreases
Solution Approach 1:
The patent segments the network parameter monitoring into multiple stages: a fast initial filtering stage that processes all parameters at high speed to identify suspicious traffic patterns, followed by a deeper analysis stage that focuses computational resources only on potentially malicious flows. This segmentation enables the system to maintain high processing speed for routine traffic while providing comprehensive detection coverage for suspicious patterns.
Data Source
AI summary
A method, network system and computer storage medium for DDoS defence in a packet-switched network are provided. The method is performed by a network system and includes: measuring a plurality of network parameters in incoming network traffic; ranking the plurality of measured network parameters based on machine learning; measuring a subset of the plurality of network parameters in incoming network traffic; determining an incoming network packet to be part of a DDoS attack or not by machine learning of the subset of the plurality of network parameters; and blocking an incoming network packet when the incoming network packet is determined to be part of a DDoS attack.