Internet Device Classification via Fingerprinting and Attacker Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively classify internet devices as hostile or benign, particularly in distributed web service environments, leading to inadequate mitigation of denial of service (DoS) attacks, as they rely on single-computer data structures and IP addresses, which cannot differentiate between multiple devices sharing the same IP and are prone to disruption by polymorphic bots.
Innovation Solution
Implementing a proof-of-work protocol that uses device fingerprinting and attacker scoring to classify devices, with a web services deployment model that provides device classification services, manages request rates, and disseminates blacklists and whitelists to subscribers, enabling effective filtering and rate limiting across a distributed system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If single-computer data structures and IP addresses are used for device classification, then system simplicity is maintained, but device differentiation capability deteriorates because multiple devices sharing the same IP cannot be distinguished
Solution Approach 1:
The patent segments the device identification problem by introducing device fingerprints that uniquely identify individual devices even when they share the same IP address. This segmentation allows the system to differentiate between multiple devices at the device level rather than the network level, resolving the contradiction between system simplicity and device differentiation capability.
Solution Approach 2:
The patent adds another dimension to device identification by incorporating device fingerprints as a new identifier dimension alongside IP addresses. This dimensional expansion enables the system to distinguish devices that would otherwise be indistinguishable, improving measurement precision without significantly increasing system complexity.
2Measurement precision
If proof-of-work protocol with device fingerprinting is implemented, then device classification accuracy is improved, but computational requirements and system complexity increase
Solution Approach 1:
The patent applies preliminary action by computing device fingerprints once during the initial connection phase and caching them for subsequent use. This preliminary computation avoids repeated complex calculations for each request, improving classification accuracy while limiting the increase in system complexity to the initial setup phase.
Solution Approach 2:
The patent uses copying by creating and storing device fingerprint copies in cache memory for rapid retrieval and comparison. This copying mechanism enables accurate device classification without requiring complex real-time computations, thus improving measurement precision while keeping system complexity manageable through efficient data reuse.
3Reliability
If distributed web service architecture is used, then service availability and scalability are improved, but coordination overhead and data consistency challenges increase
Solution Approach 1:
The patent applies universality by creating a centralized device classification service that can be shared across multiple web service instances. This universal service handles device fingerprinting and classification for the entire distributed system, improving service availability through centralized coordination while reducing overall system complexity by avoiding redundant classification logic at each node.
Solution Approach 2:
The patent introduces an intermediary device classification service that mediates between client devices and the distributed web service infrastructure. This intermediary handles the complex tasks of device fingerprinting, classification, and blacklist/whitelist management, thereby improving service availability while isolating coordination overhead to a dedicated component rather than spreading it across all system elements.
4Object-affected harmful factors
If device-based filtering and rate limiting are implemented, then DoS attack mitigation is improved, but legitimate request processing overhead increases
Solution Approach 1:
The patent applies preliminary action by performing device classification and determining rate limits during the initial connection phase before actual request processing begins. This preliminary classification allows the system to establish per-device rate limits in advance, improving DoS attack mitigation while minimizing processing overhead during legitimate request handling since the classification work is already done.
Solution Approach 2:
The patent implements self-service by having the device classification service automatically manage blacklists and whitelists based on observed device behavior patterns. This automated self-service approach improves DoS attack mitigation through dynamic blacklist updates while reducing the need for manual intervention and minimizing processing overhead by using pre-computed classification results for rate limiting decisions.
Data Source
AI summary
Systems and methods for classification of internet devices for classifying devices on the Internet as either hostile or benign. Hostile devices are those that are or will be engaging in denial of service attacks. The systems and methods for classification of internet devices as hostile or benign generally include 1) a proof-of-work protocol, 2) a method for adjusting a device's ‘attacker score’ based on its protocol behavior, 3) a method for detecting tampering of puzzle parameters, 4) a method for limiting request rates of both benign and hostile devices, 5) a method for collecting device fingerprints and their associated status from a high-speed memory cache and persisting them to a database, 6) a web services deployment model to provide device classification services to third parties, and 7) a method for dissemination of device blacklists and whitelists to all subscribers of the web service 8) a deployment model of the attacker identification system as a request filter at the front-end of a distributed web services system, and 9) a management server for control of the system parameters to enable various modes of classification and device request rate limiting.