DDoS Attack Detection Using Payload Bit Encoding and Sparse Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DDoS attack mitigation methods are inadequate as they fail to accurately distinguish between legitimate and malicious traffic, do not allow for flexible policy configuration, and can degrade system performance, especially in detecting high-rate attacks and overloaded network resources.
Innovation Solution
A method using statistical analysis to detect patterns in network traffic by encoding payload lengths and content with a bit encoding scheme, storing results in a sparse memory array, and performing bitwise operations to identify attack patterns and types, enabling real-time mitigation without degrading system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard mitigation policies discard all packets destined to victim server, then DDoS attack traffic is blocked, but legitimate user traffic is also blocked and system performance degrades
Solution Approach 1:
The patent segments traffic analysis into distinct phases: learning phase for pattern identification and detection phase for attack identification. It also segments packets into header fields and payload content, analyzing each separately with appropriate methods. This segmentation allows the system to maintain performance while achieving reliable mitigation by processing different traffic components through specialized pathways.
Solution Approach 2:
The system performs preliminary learning during a learning phase before actual attack detection, building pattern templates and establishing baseline behavior. This preliminary action enables the detection phase to operate more efficiently with pre-computed patterns and thresholds, improving real-time performance while maintaining accurate mitigation.
2Measurement precision
If packet analysis is performed to distinguish legitimate from malicious traffic, then mitigation accuracy improves, but processing time increases and system performance degrades
Solution Approach 1:
The patent divides packet analysis into header field analysis and payload content analysis, processing each with optimized methods. Header fields are analyzed using efficient pattern matching, while payloads use statistical analysis of character frequencies. This segmentation enables parallel processing and reduces overall analysis time while maintaining high accuracy.
Solution Approach 2:
The system dynamically adjusts analysis parameters such as payload length thresholds and character frequency criteria based on learned traffic patterns. By changing these parameters adaptively, the system optimizes the balance between analysis depth and processing speed, maintaining accuracy while reducing unnecessary processing overhead.
3Measurement precision
If comprehensive packet analysis is performed to detect attack patterns, then detection accuracy improves, but resource consumption increases
Solution Approach 1:
The patent extracts only the most relevant features from packets for analysis: specific header fields and payload content characteristics. By extracting only essential information rather than analyzing entire packets, the system achieves accurate detection while minimizing CPU time and bandwidth consumption associated with processing all packet data.
Solution Approach 2:
The system performs partial analysis on packets that meet certain criteria (e.g., payload length within specific ranges) and full analysis only when necessary. This selective approach ensures detection accuracy for suspicious packets while reducing resource consumption on normal traffic, achieving the right balance between thoroughness and efficiency.
4Adaptability or versatility
If flexible policy configuration is implemented, then adaptability to different attack types improves, but system complexity increases
Solution Approach 1:
The patent implements dynamic policy configuration where mitigation parameters such as payload length thresholds and character frequency criteria can be adjusted based on learned traffic patterns and detected attack types. This dynamic adaptability allows the system to respond flexibly to different attacks while the underlying pattern recognition algorithms maintain manageable complexity through statistical methods.
Data Source
AI summary
A method of detecting patterns in network traffic is provided. The method includes receiving a plurality of packets of network traffic, each packet having a payload populated with payload data and selecting payload lengths that occurred most frequently. For each of the selected payload lengths, a pattern template is generated using characters per position of the payload that satisfy a frequency criterion. A bit encoding scheme is assigned for each of the selected payload lengths and its associated pattern template. Each packet of the plurality of packets that has a payload length equal to any of the selected payload lengths and payload content that matches a pattern template generated for the payload is encoded into a single value. The single value uses the bit encoding scheme for the payload length and the pattern template matched. Each potential combination of fields representing the respective payload length and the pattern template is stored, with either all bits set per field when the field is active or no bits set per field when the field is inactive. A bitwise operation is performed on each encoded packet with the stored potential combinations. Results of the bitwise operation are stored in a sparse memory array. The results of the sparse array are sorted based on a number of the active fields and a number of occurrences of the respective results of the bitwise operation. The results of the sorting are provided to a mitigation device as an indication of whether an attack is underway and/or what type of attack is underway.