Distributed Voting Mechanism for Low Power Lossy Network Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low Power and Lossy Networks (LLNs) face challenges in detecting Denial of Service (DoS) attacks due to limited resources and dynamic conditions, leading to difficulties in distinguishing between legitimate and malicious traffic, and existing solutions suffer from high false positives and network overhead.
Innovation Solution
A distributed voting mechanism is implemented, where network nodes execute classifiers on a validation dataset to select an optimal set of voting classifiers, reducing false positives by optimizing the voting strategy and consensus threshold, and allowing local voting to minimize network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a distributed voting mechanism is implemented for attack detection, then detection accuracy is improved, but network overhead and false positives increase
Solution Approach 1:
The network is segmented into multiple voting domains, each handling local attack detection votes. This segmentation allows parallel processing of detection tasks across different domains, improving overall detection accuracy while distributing the network overhead across multiple smaller, manageable units rather than a single centralized system
Solution Approach 2:
The system performs preliminary classification of traffic as malicious or legitimate before initiating the full voting process. This preliminary action filters out obviously benign traffic, reducing the number of votes needed and thereby decreasing network overhead while maintaining high detection accuracy for suspicious traffic
2Reliability
If multiple classifiers are used for voting, then detection reliability is improved, but computational load increases
Solution Approach 1:
The system uses a dynamic threshold for the number of classifiers required to trigger a vote. For low-risk traffic, fewer classifiers are invoked (partial action), reducing computational load. For high-risk traffic, the full set of classifiers is activated (excessive action), ensuring high reliability. This adaptive approach balances reliability requirements with computational constraints
Solution Approach 2:
The voting mechanism dynamically adjusts the number and type of classifiers involved based on traffic characteristics and current network conditions. This dynamic adaptation allows the system to maintain high detection reliability when needed while reducing computational load during normal operation, resolving the contradiction between reliability and energy consumption
3Measurement precision
If consensus threshold is lowered, then false positives are reduced, but detection speed decreases
Solution Approach 1:
The system dynamically changes the consensus threshold parameter based on the detected traffic pattern and risk level. For high-confidence detections, a lower threshold is applied to maintain speed. For ambiguous cases, the threshold is raised to reduce false positives. This parameter adaptation allows the system to optimize both detection speed and accuracy in different operational contexts
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, voting optimization requests that identify a validation data set are sent to a plurality of network nodes. Voting optimization data is received from the plurality of network nodes that was generated by executing classifiers using the validation data set. A set of one or more voting classifiers is then selected from among the classifiers based on the voting optimization data. One or more network nodes that host a voting classifier in the set of one or more selected voting classifiers is then notified of the selection.