DDoS Detection via Statistical Traffic Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DDoS attack mitigation methods are inadequate as they fail to distinguish between legitimate and malicious traffic, lack real-time data export capabilities, and do not allow for flexible policy configuration, leading to inefficient handling of high-rate DDoS attacks that can overwhelm network resources.
Innovation Solution
A monitoring system and method using statistical analysis to detect patterns in network traffic by generating value combinations, storing them in a results table, and calculating metrics like Time-to-Live distribution, average packet length, and packet per second rates to identify anomalous traffic patterns and differentiate between legitimate and malicious users, while maintaining system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If standard mitigation policies discard all packets destined to a victim server, then DDoS attack mitigation is simplified, but legitimate traffic is also blocked and system performance degrades
Solution Approach 1:
The patent segments packet filtering by creating multiple result tables (first result table for DDoS detection, second result table for legitimate traffic identification). Instead of discarding all packets uniformly, the system divides packet processing into distinct categories based on detected patterns, allowing selective filtering that preserves legitimate traffic while blocking malicious packets.
Solution Approach 2:
The patent applies local quality by differentiating packet handling based on specific detected characteristics. Packets are classified into different groups (DDoS attack traffic vs. legitimate traffic) based on their patterns, and each group receives appropriate handling. This allows the system to maintain high throughput for legitimate traffic while effectively blocking DDoS packets.
2Speed
If standard approaches do not analyze packet structures, then processing speed is maintained, but ability to distinguish attacker from legitimate user is lost
Solution Approach 1:
The patent performs preliminary analysis of packet structures during the normal packet processing flow. By analyzing packet patterns, source IP addresses, and other characteristics in advance and storing results in result tables, the system prepares classification data before final packet decisions are made. This preliminary action enables accurate traffic differentiation without significantly slowing down the overall processing speed.
Solution Approach 2:
The system uses feedback mechanisms where packet analysis results are stored in result tables and used to inform subsequent packet processing decisions. The detection of DDoS patterns or legitimate traffic patterns provides feedback that guides future packet handling, improving differentiation accuracy while maintaining processing efficiency through cached results.
3Device complexity
If real-time data export is not implemented, then system complexity is reduced, but ability to respond to attacks in real-time is limited
Solution Approach 1:
The patent merges multiple functions into the packet processing flow: DDoS detection, legitimate traffic identification, and real-time data export are combined in a unified processing architecture. The first and second result tables store real-time data during packet processing, enabling immediate export of attack information without adding separate complex systems. This integration reduces overall system complexity while enabling real-time response.
4Ease of operation
If flexible policy configuration is not allowed, then system operation is simplified, but operator ability to customize mitigation strategies is lost
Solution Approach 1:
The patent implements dynamic policy configuration where operators can customize mitigation strategies based on detected attack patterns. The system allows flexible configuration of filtering criteria, threshold values, and response actions in the packet processing flow. This dynamic capability enables operators to adapt mitigation policies to specific attack scenarios while maintaining simple operation through automated detection and classification.
Data Source
AI summary
A method for detecting patterns using statistical analysis is provided. The method includes receiving a subset of structured data having a plurality of fields. A plurality of value combinations is generated for the plurality of fields using a statistical combination function. Each combination of the generated plurality of value combinations is stored as a separate entry in a results table. The entry in the results table includes a counter associated with the stored combination. A value of the counter is incremented for every occurrence of the stored combination in the generated plurality of value combinations. The results table is sorted based on the counters' values and based on a number of fields in each combination. One or more entries having highest counter values are identified in the results table.