Dynamic IP Allocation Mitigation via RADIUS-Based DDoS Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems face challenges in effectively detecting and mitigating denial of service attacks, especially in networks with dynamically assigned IP addresses, as conventional methods fail to reliably identify and address the issue without causing unnecessary disruptions.
Innovation Solution
A method involving an Internet gateway that monitors traffic, stores data, and uses machine learning algorithms to identify IP addresses under attack, temporarily preventing their allocation to customer interfaces, thereby mitigating the attack by preventing the IP address from being allocated to other devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If IP addresses are dynamically assigned from common pools to individual customers, then network scalability and resource utilization are improved, but the reliability of anomaly detection deteriorates because IP addresses change over time
Solution Approach 1:
The patent introduces RADIUS data as an intermediary that provides a stable mapping between transient IP addresses and persistent network entities. The RADIUS server maintains authentication and accounting records that link IP addresses to customer identifiers, allowing the system to track network entities reliably even as their IP addresses change dynamically.
Solution Approach 2:
The system creates a copy of the stable network entity identifier from RADIUS data to associate with the transient IP address. This copying mechanism allows anomaly detection to be performed on the stable entity identifier while the IP address remains dynamic, resolving the contradiction between scalability and detection reliability.
2Productivity
If conventional anomaly detection methods are used without preventing IP address reallocation during attacks, then network resource utilization is maintained, but the effectiveness of attack mitigation deteriorates
Solution Approach 1:
The system performs preliminary detection of denial of service attacks by analyzing traffic patterns against baseline behavior before the attack fully propagates. Once an attack is detected on a particular IP address, the system preemptively prevents reallocation of that IP address to new customers, stopping the attack chain before it can affect additional network entities.
Solution Approach 2:
The patent converts the normally harmful effect of IP address reallocation (which spreads attacks) into a beneficial security feature. By detecting attacks and blocking IP address reallocation during attack periods, the system transforms the dynamic IP assignment mechanism from a vulnerability into an active defense mechanism that contains attacks within specific time windows.
3Productivity
If IP addresses are continuously reallocated during denial of service attacks, then network address utilization efficiency is improved, but the severity of the attack propagates to more network entities
Solution Approach 1:
The system detects denial of service attacks by comparing current traffic patterns against established baselines and takes preliminary action to prevent IP address reallocation before the attack can spread. This preliminary intervention maintains address utilization efficiency by allowing normal allocations to continue while blocking reallocations during detected attack periods.
Solution Approach 2:
The patent extracts the problematic reallocation function during attack periods by preventing the IP address pool from being reassigned to new entities. This extraction isolates the attack to the affected IP address while maintaining overall network efficiency, as non-attacked IP addresses continue to be allocated normally.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method of operating a network is disclosed which mitigates distributed denial of service attacks to a greater degree than conventional approaches. Distributed denial of service attacks are often targeted at a given network address. In networks offering dynamic network address allocation to network devices, this can result in a network address being allocated to a succession of different network devices during the lifetime of a distributed denial of service attack - in part because the attack can overwhelm each network device in turn, in each case causing the network device to relinquish the network address allocated to it. This problem is tackled by identifying a network address subject to a distributed denial of service attack, and then temporarily removing that network address from the pool of network addresses available to network devices. This prevents network devices other than the device having the network address at the start of the DDoS attack from being impacted by the DDoS attack. In an embodiment, identification of targeted network addresses is performed using a classification algorithm generated by applying machine learning techniques to accounting data sent by one or more network gateways to an Authentication, Authorization and Accounting server.