DDoS Filtering Avoiding Over-Mitigation via Packet Field Combinations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional automated systems for mitigating DDoS attacks often result in over-mitigation, where legitimate traffic is filtered along with malicious traffic, leading to unnecessary interference with network operations.
Innovation Solution
A computerized method and system that processes network traffic by generating unique combinations of packet fields, incrementing match counters for both good and bad traffic, sorting these combinations based on match counters, number of fields, and filtering them to selectively apply filters, thereby distinguishing between legitimate and malicious traffic to avoid over-mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If automated mitigation techniques are used to filter malicious traffic during DDoS attacks, then the ability to block attack traffic is improved, but legitimate traffic is incorrectly filtered along with malicious traffic (over-mitigation)
Solution Approach 1:
The patent segments the filtering process by analyzing individual packet fields separately and combining them through unique combinations. Instead of filtering based on a single field, the system creates multiple field combinations (e.g., source IP, destination IP, protocol, port) and tracks their occurrences to distinguish attack patterns from legitimate traffic, thereby reducing over-mitigation while maintaining effective DDoS blocking
Solution Approach 2:
The patent performs preliminary analysis by pre-processing network traffic data before actual filtering occurs. The system analyzes packet fields, generates unique combinations, and stores statistical information about their occurrences in advance. This preliminary action enables more accurate filtering decisions during actual attacks by using pre-computed patterns and counts to identify malicious traffic without incorrectly blocking legitimate traffic
2Reliability
If conventional filtering methods are applied to block attack traffic, then DDoS protection is improved, but the complexity of traffic analysis and false positive reduction is insufficient
Solution Approach 1:
The patent extracts and analyzes specific fields from network packets (source IP, destination IP, protocol type, port numbers) separately from the full packet data. By taking out these individual fields and examining their unique combinations, the system reduces the complexity of analyzing entire packets while maintaining the ability to accurately identify attack patterns through statistical analysis of field combinations
Data Source
AI summary
A method of detecting patterns for automated filtering of data is provided. The method includes receiving network traffic including bad traffic and good traffic, wherein an attack is known to be applied to the bad traffic, and the good traffic is known to be free of an applied attack. Processing the good and bad traffic includes generating, for each unique packet, each potential unique combination of the packet's fields, storing each combination with associated bad match and good match counters, and incrementing a combination's respective good and bad match counters for each occurrence it matches one of the packets of the respective good and bad traffic. The combinations are sorted based on the good match counter associated with each combination, a number of fields in each combination, and the bad match counter associated with each combination. One or more combination is selected based on results of the sorting for provision to a network traffic filtering component.