Automated DDoS Mitigation via Application Layer Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques face challenges in detecting and mitigating distributed denial of service (DDoS) attacks, as they often mimic legitimate network traffic, making it difficult to distinguish between malicious and legitimate traffic.
Innovation Solution
A system that analyzes changes in application layer properties of network traffic to identify a signature of DDoS attacks by measuring entropy changes, generating a mitigation rule that maximizes the impact on attack-related traffic while minimizing the impact on legitimate traffic, and configuring a web application firewall to block or manage traffic associated with the attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional DDoS detection techniques are used, then attack detection capability is limited, but legitimate traffic is incorrectly blocked
Solution Approach 1:
The system changes the parameters used for traffic analysis from traditional network layer parameters to application layer parameters, specifically measuring entropy changes in application layer traffic properties. This parameter transformation enables more accurate distinction between attack and legitimate traffic patterns without falsely blocking legitimate users.
Solution Approach 2:
The system moves the analysis from traditional network layer to application layer, adding a new dimension of analysis. By examining application layer properties and their entropy changes, the system creates a more refined classification space that separates malicious from legitimate traffic more effectively.
2Object-affected harmful factors
If aggressive traffic blocking is applied, then attack impact is reduced, but legitimate traffic is also blocked
Solution Approach 1:
The system applies different quality thresholds to different traffic patterns by establishing separate baseline entropy values for legitimate traffic and attack traffic. This localized quality assessment allows the system to block only traffic that deviates significantly from legitimate patterns while preserving normal traffic flow.
Solution Approach 2:
The system continuously monitors traffic patterns and updates baseline entropy values dynamically. This feedback mechanism allows the system to adapt to changing traffic conditions and adjust blocking thresholds in real-time, ensuring that legitimate traffic is not blocked while maintaining protection against attacks.
3Measurement precision
If manual rule configuration is used, then firewall rules may be inaccurate, but automated signature generation is complex
Solution Approach 1:
The system performs self-service by automatically generating attack signatures through entropy analysis without requiring manual configuration. The automated process analyzes traffic patterns, identifies entropy changes, and generates accurate firewall rules autonomously, eliminating the need for manual rule creation while maintaining high accuracy.
Solution Approach 2:
The system replaces the manual mechanical process of rule configuration with an automated computational process based on entropy measurement. This substitution transforms the complex manual task into an automated algorithmic process that objectively analyzes traffic and generates rules based on mathematical entropy calculations.
Data Source
AI summary
A distributed denial of service attack is detected. In response to detection of the attack, application layer properties of network traffic associated with a web application under attack are analyzed. Changes to distributions of the application layer properties are identified. A signature is generated based, at least in part, on identifying a combination of application layer properties whose distributions have changed, and which identifies traffic increased since onset of the attack. A mitigation rule is generated based, at least in part, on the signature.