DDoS Mitigation via Destination Signature Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively mitigate Distributed Denial of Service (DDoS) attacks due to the difficulty in distinguishing malicious data traffic from legitimate traffic, as attackers often spoof source addresses, overwhelming target devices with volumetric or application-layer attacks.
Innovation Solution
A system and method that utilize a mitigation device to analyze data packets for destination address signatures, count occurrences within data packet windows, and implement rate limiting if the number of occurrences exceeds a threshold, thereby blocking malicious traffic based on destination addresses rather than spoofed source addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If source address-based blocking or rate limiting is used to mitigate DDoS attacks, then attack traffic can be filtered, but legitimate traffic cannot be distinguished from malicious traffic due to address spoofing
Solution Approach 1:
The patent introduces an intermediary verification mechanism using TCP handshake packets as a mediator. The mitigation device acts as an intermediary that verifies the authenticity of source addresses by checking the TCP three-way handshake process. Legitimate clients complete the handshake while spoofed addresses fail to respond to SYN-ACK packets, allowing the system to distinguish between real and fake traffic without blocking legitimate users.
Solution Approach 2:
The system performs preliminary verification of source address authenticity before allowing full traffic flow. By checking the TCP handshake completion in advance, the mitigation device identifies and blocks malicious traffic patterns before they can overwhelm the target, while legitimate traffic that completes the handshake is allowed through normally.
2Reliability
If all data packets are blocked to prevent DDoS attacks, then target device protection is improved, but legitimate user access is also prevented
Solution Approach 1:
Instead of blocking all traffic or using a single threshold, the patent implements partial blocking based on the proportion of failed TCP handshakes. The system calculates the ratio of SYN-ACK packets without corresponding ACK responses and only blocks traffic when this ratio exceeds a threshold (e.g., 50%). This partial action approach allows legitimate traffic to pass while blocking only the excessive malicious traffic that fails the handshake verification.
Solution Approach 2:
The system dynamically changes the mitigation parameters based on observed traffic patterns. The blocking threshold and rate limiting parameters are adjusted according to the calculated proportion of failed handshakes in different time windows, allowing the system to adapt to varying attack intensities while maintaining legitimate user access during normal conditions.
3Reliability
If rate limiting is applied to all destination addresses, then attack traffic is reduced, but legitimate traffic throughput is also reduced
Solution Approach 1:
The patent applies rate limiting locally and selectively to specific destination addresses that exhibit malicious patterns, rather than applying uniform rate limiting to all traffic. The system identifies destination addresses receiving disproportionate failed handshake attempts and applies rate limiting only to those specific targets, allowing legitimate traffic to other destinations to flow at full throughput.
Solution Approach 2:
The system applies rate limiting as a partial measure only when and where needed. By monitoring the proportion of failed handshakes per destination address and applying rate limiting only when this proportion exceeds the threshold, the system avoids excessive blocking of legitimate traffic while still effectively mitigating attacks on targeted destinations.
Data Source
AI summary
A method and associated system for mitigating a Distributed Denial of Service (DDoS) attack on a target device including, receiving a plurality of data packets at a mitigation device, counting a number of occurrences of each destination address signature within each of a plurality of consecutive data packet windows, classifying each data packet window of the plurality of consecutive data packet windows as a potential attack window if the number of occurrences of any one destination address signature within the data packet window exceeds a destination address signature threshold value. The method further includes, determining a total number of potential attack windows within a sliding time window and limiting the transmission of the plurality of data packets from the mitigation device if a total number of potential attack windows within the sliding time window exceeds a potential attack window threshold value.