DDoS Detection via File DNA and Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DDoS attack detection and prevention methods struggle to effectively identify and mitigate attacks, especially when attackers use normal network packets without distinctive patterns and construct large-scale botnets, making it difficult to differentiate between legitimate and malicious traffic.
Innovation Solution
A method and server system in a cloud computing environment that collects and analyzes file DNA and traffic information from clients using a monitoring agent, classifies files as normal, malicious, or unidentified, and sends commands to block files with high risk levels, utilizing a database to store and analyze statistical information for enhanced detection and prevention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional DDoS detection methods use unique attack patterns (SYN flood, TCP flag flood, HTTP flood, UDP flood), then detection capability is improved, but effectiveness deteriorates as attackers use normal network packets without distinctive patterns
Solution Approach 1:
The patent changes the detection parameter from packet-level patterns (SYN flood, TCP flag flood) to file-level characteristics (file DNA, execution behavior). By monitoring the DNA and execution behavior of files on client systems, the system can detect DDoS attacks even when attackers use normal network packets, as the malicious files themselves leave detectable traces in the file system and execution logs.
Solution Approach 2:
The patent introduces an intermediary layer between network traffic and detection. Instead of directly analyzing network packets for attack patterns, the system uses file monitoring agents as intermediaries that track the execution of files and their network behavior. This intermediary approach allows detection of attacks that use normal packet formats by focusing on the malicious software components themselves.
2Object-generated harmful factors
If DDoS attackers construct large-scale botnets with many attacking computers, then attack strength is improved, but detection difficulty worsens as it becomes harder to differentiate legitimate from malicious traffic
Solution Approach 1:
The patent segments the detection task from centralized server-based detection to distributed client-based monitoring. By installing monitoring agents on individual client systems, the system can detect DDoS attacks at the source rather than trying to distinguish malicious traffic from legitimate traffic at the destination. This segmentation makes detection easier even in large-scale botnet scenarios where many computers are involved.
Solution Approach 2:
The patent replaces the mechanical approach of analyzing network traffic patterns with a software-based approach of monitoring file execution characteristics. By substituting network-level analysis with file-system-level monitoring, the system can reliably identify malicious files regardless of the scale of the botnet or the complexity of the attack traffic.
3Adaptability or versatility
If DDoS attack tools are distributed through various routes and malware (Trinoo, TFN, Stacheldraht), then attack versatility is improved, but prediction and defense effectiveness deteriorates
Solution Approach 1:
The patent creates a universal detection mechanism that works across multiple attack vectors and tool types. By monitoring file DNA and execution behavior rather than looking for specific attack patterns, the system can detect and respond to various DDoS tools (Trinoo, TFN, Stacheldraht) and malware variants using a single unified approach, making defense effective regardless of the specific attack method employed.
Data Source
AI summary
A method for detecting and preventing a Distributed Denial of Service (DDoS) attack in a cloud computing environment including a plurality of clients connected to a server, the method includes collecting, by the server, file deoxyribonucleic acid (DNA) extracted from a file currently being executed by each of the clients and traffic information about network traffic caused by the file, from each client by using an agent that is installed in the client and that monitors the file currently being executed by the client. Further, the method includes analyzing, by the server, a risk level of a DDoS attack based on whether the file DNA of the file is malicious or unidentified and based on the traffic information. Furthermore, the method includes sending a command related to whether to block the file to the client according to the analyzed risk level.