DDoS Mitigation via Traffic Log Correlation and Probabilistic Filtering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Identifying and distinguishing between malicious and legitimate traffic during Distributed Denial of Service (DDoS) attacks is challenging, especially as attackers exploit vulnerabilities in Internet-of-Things devices, making it difficult to protect critical infrastructure.

Innovation Solution

A method and apparatus for configuring DDoS mitigation devices by correlating traffic logs from multiple DDoS attacks to identify recurring transaction sources using secure multiparty computation and Heavy Hitter algorithms, generating a list of suspicious sources to filter out malicious traffic while preserving confidentiality and reducing memory consumption.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traffic logs from multiple DDoS attacks are correlated to identify recurring transaction sources, then detection accuracy of suspicious sources is improved, but computational complexity and memory consumption increase

Engineering Contradiction:

Improvedetection accuracyVSAvoidcomputational complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent replaces traditional mechanical correlation methods with cryptographic protocols (secure multiparty computation) and efficient data structures (HyperLogLog, Bloom filters) to identify recurring transaction sources across multiple traffic logs. This substitution enables accurate detection of suspicious sources while significantly reducing computational complexity and memory consumption compared to brute-force correlation approaches.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If traffic logs from multiple DDoS attacks are correlated to identify recurring transaction sources, then detection accuracy of suspicious sources is improved, but memory consumption increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidmemory consumption

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent substitutes traditional memory-intensive correlation algorithms with probabilistic data structures (HyperLogLog, Bloom filters) that provide approximate counting and membership testing with constant or logarithmic memory usage. This enables the system to maintain high detection accuracy while consuming minimal memory resources even when processing large volumes of traffic logs from multiple attacks.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent changes the parameter of memory consumption from linear growth with input size to constant or logarithmic growth by employing probabilistic data structures. HyperLogLog provides approximate cardinality estimation using O(log log N) memory, while Bloom filters provide membership testing with O(k) memory where k is the number of elements, fundamentally changing the scalability characteristics of the correlation process.

Inventive Principle:

Principle #35Parameter changes

3Loss of information

If secure multiparty computation is performed to determine transaction sources appearing in multiple traffic logs, then confidentiality between Internet service providers is preserved, but computational overhead increases

Engineering Contradiction:

ImproveconfidentialityVSAvoidcomputational overhead

Core Design Contradiction:

Loss of informationVSDevice complexity

Solution Approach 1:

The patent replaces traditional secure multiparty computation protocols with more efficient cryptographic primitives and probabilistic data structures that achieve the same confidentiality goals with reduced computational overhead. By using Bloom filters and HyperLogLog in a distributed setting with appropriate access controls, the system preserves confidentiality between ISPs while avoiding the heavy computational burden of full MPC protocols.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

4Quantity of substance

If Heavy Hitter algorithm is used to determine transaction sources appearing in multiple traffic logs, then memory consumption is reduced, but detection precision may decrease

Engineering Contradiction:

Improvememory consumptionVSAvoiddetection precision

Core Design Contradiction:

Quantity of substanceVSMeasurement precision

Solution Approach 1:

The patent merges multiple probabilistic data structures (HyperLogLog for cardinality estimation, Bloom filters for membership testing) to compensate for the approximate nature of individual structures. By combining these structures with threshold-based filtering and validation logic, the system maintains detection precision comparable to exact methods while achieving constant memory consumption, effectively merging the advantages of different probabilistic approaches.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentEP3595257B1Detecting suspicious sources, e.g. for configuring a distributed denial of service mitigation device

Publication Date: 2020.12.30 NOKIA SOLUTIONS & NETWORKS OY

Figure 1
Figure 2
Figure 3~4

AI summary

An apparatus (20) may access (25) a plurality of traffic logs (16) recorded at one or more network elements during a plurality of distributed denial of service (DDoS) attacks. A traffic log (16) comprises source information relating to transaction sources from which transactions received by a said network element during a said DDoS attack originate. The apparatus (20) may correlating the traffic logs (16) to determine transaction sources of that appear in a number of traffic logs higher than a defined threshold. The apparatus (20) may configure (27) a DDoS mitigation device (29) as a function of the determined transaction sources such as e.g. a firewall, a router or other appliances having a traffic filtering function.