Distributed Voting Mechanism for Network Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low Power and Lossy Networks (LLNs) face challenges in detecting Denial of Service (DoS) attacks due to limited resources and dynamic conditions, making it difficult to distinguish between legitimate and malicious traffic, especially in distributed DoS attacks.
Innovation Solution
A distributed voting mechanism is implemented where network nodes detect potential attacks using local classifiers and send voting requests to neighboring nodes, which validate the detection using their own classifiers, reducing false positives and conserving network resources by limiting alarms sent to central devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a distributed voting mechanism is implemented for attack detection, then measurement precision and reliability of attack detection are improved, but device complexity and communication overhead increase
Solution Approach 1:
The attack detection system is segmented into multiple independent network nodes, each executing its own local classifier. Instead of a centralized detection system, each node independently analyzes traffic features and generates detection results, which are then combined through a voting mechanism to achieve more accurate and reliable attack detection.
Solution Approach 2:
Multiple detection results from different network nodes are merged through a voting mechanism. Each node's classification output is combined with others to determine the final attack detection result, leveraging collective intelligence to improve measurement precision while distributing the computational burden.
2Speed
If local classifiers are executed at each network node, then detection speed and responsiveness are improved, but use of energy and processing resources increase
Solution Approach 1:
Each network node executes a lightweight local classifier that performs partial detection independently. The classifier processes only essential traffic features locally to generate quick detection results, while more complex analysis is distributed across the network through the voting mechanism, achieving fast detection without excessive resource consumption at each node.
3Reliability
If voting requests are sent to multiple neighboring nodes, then reliability of attack detection is improved, but loss of energy and communication overhead increase
Solution Approach 1:
The voting mechanism acts as an intermediary process that coordinates communication between network nodes. Instead of direct peer-to-peer communication for validation, nodes send voting requests and results through a standardized voting protocol, which manages the communication overhead and energy consumption while maintaining detection reliability.
4Measurement precision
If distributed voting is used to validate detections, then false positives are reduced, but loss of time for coordination increases
Solution Approach 1:
Network nodes perform preliminary classification using local classifiers before engaging in the voting process. This preliminary action filters out obvious non-attack traffic at each node, reducing the number of voting interactions needed and minimizing coordination time while maintaining low false positive rates through the subsequent voting validation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, a network node receives a voting request from a neighboring node that indicates a potential network attack. The network node determines a set of feature values to be used as input to a classifier based on the voting request. The network node also determines whether the potential network attack is present by using the set of feature values as input to the classifier. The network node further sends a vote to the neighboring node that indicates whether the potential network attack was determined to be present.