Service Priority Control Under DDoS Resource Saturation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing systems face increased operational costs due to resource allocation during distributed denial of service (DDoS) attacks, as they allocate excessive resources to maintain service functionality, leading to inefficient resource management.
Innovation Solution
An attack monitoring apparatus that identifies high-load attacks, determines attack target services, and adjusts resource allocation based on priority levels to restrict or migrate services, optimizing resource usage and maintaining critical services during DDoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a cloud allocates a large amount of resources to a service subjected to a DDoS attack to maintain service functionality, then the service availability is improved, but the operation cost is greatly increased
Solution Approach 1:
The patent applies local quality by differentiating resource allocation based on service priority levels. Instead of uniformly allocating resources to all services under attack, the system identifies critical services requiring protection and allocates resources selectively to those specific services, while reducing or stopping resource allocation to non-critical services. This localized approach maintains service availability for important functions without incurring the full cost of protecting all services equally.
Solution Approach 2:
The patent changes the parameter of resource allocation dynamically based on service priority and attack detection. The system adjusts resource allocation parameters in real-time: increasing resources for high-priority services under attack while decreasing or halting resources for low-priority services. This parameter change enables the system to maintain critical services during attacks while controlling overall operation costs.
2Productivity
If a cloud automatically allocates resources to enhance computing capability when processing load is high, then the processing capability is improved, but the resource waste increases during DDoS attacks
Solution Approach 1:
The patent implements dynamic resource allocation that adapts to changing conditions. The system continuously monitors service load and attack patterns, then dynamically adjusts resource allocation accordingly. During normal operation, resources are allocated based on processing needs to enhance capability. During detected DDoS attacks, the system dynamically shifts allocation to only essential services, preventing resource waste while maintaining necessary processing capability for critical functions.
Solution Approach 2:
The patent introduces a resource allocation management system that acts as an intermediary between service requests and actual resource allocation. This intermediary layer detects attacks and service priorities, then mediates resource distribution by blocking or redirecting resources away from non-critical services under attack while ensuring adequate resources reach critical services. This mediation prevents resource waste during attacks while maintaining processing capability where needed.
Data Source
AI summary
In an information processing apparatus according to an embodiment, a processor acquires a load state of each resource in an information processing system, and determines whether one of the resources is subjected to a high-load attack. In response to affirmative determination, the processor identifies an attack target service subjected to the high-load attack from among services executed in the information processing system, based on the attack target resource subjected to the high-load attack among the resources. The processor determines a priority of the attack target service based on priority information in which priority indicating a level at which each service is preferentially processed is described. The processor determines, based on the priority of the attack target service, a target restriction content indicating a content to restrict execution of one of the services. The processor restricts the execution of the one of the services according to the target restriction content.