DNS Amplification Detection via IPFIX Semi-Supervised Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems are vulnerable to DNS amplification attacks, which exploit the DNS resolver's resources to overwhelm target systems with amplified traffic, making it difficult to detect and mitigate such attacks, especially in cloud environments where access to payload data is restricted.
Innovation Solution
A semi-supervised machine learning approach using IPFIX data to train an amplification attack detection system by creating and propagating labels, leveraging threat intelligence alerts and Netflow/IPFIX data to identify and classify DNS amplification attacks, even with limited labeled data, allowing for effective detection and prevention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If DNS resolvers are made open to the world to provide universal service, then service accessibility is improved, but vulnerability to amplification attacks increases
Solution Approach 1:
The patent applies preliminary action by training machine learning models in advance using labeled IPFIX data to detect amplification attacks. The system prepares detection capabilities beforehand using semi-supervised learning, enabling it to identify and block attack patterns before they can overwhelm the DNS resolver during actual service operation.
Solution Approach 2:
The patent introduces an intermediary detection system that sits between the open DNS resolver and the network traffic. This intermediary uses IPFIX data analysis and machine learning models to filter malicious amplification attacks while allowing legitimate traffic to pass through, thus protecting the resolver without restricting universal access.
2Difficulty of detecting and measuring
If traditional rule-based detection systems are used to identify amplification attacks, then detection capability is improved, but false positives increase and resource consumption rises
Solution Approach 1:
The patent changes the detection parameters from traditional rule-based thresholds to machine learning model predictions trained on IPFIX data. This parameter transformation enables more accurate identification of attack patterns, reducing false positives and optimizing resource usage by focusing computational effort on suspicious traffic patterns rather than applying rigid rules to all traffic.
Solution Approach 2:
The patent replaces the mechanical rule-based detection system with a machine learning-based detection system. Instead of applying predefined rules to filter traffic, the system uses trained models that analyze IPFIX data patterns to identify amplification attacks, resulting in lower false positive rates and more efficient resource consumption.
3Measurement precision
If labeled training data is manually collected for machine learning models, then model accuracy is improved, but time and resource requirements for data preparation increase
Solution Approach 1:
The patent applies self-service by enabling the system to automatically generate and label training data using IPFIX data and automated labeling algorithms. The semi-supervised learning approach allows the model to learn from both labeled and unlabeled data, reducing manual intervention while maintaining high accuracy in detecting amplification attacks.
Solution Approach 2:
The patent performs preliminary data preparation by collecting and labeling IPFIX data in advance using automated processes. This preliminary action creates a training dataset that can be reused for model training, eliminating the need for manual data collection and labeling during deployment and reducing overall preparation time.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
One embodiment illustrated herein includes a computer implemented method. The method includes acts for training an amplification attack detection system. The method includes obtaining a plurality of samples of IPFIX data. The method further includes using the IPFIX data to create a plurality of time-based, server samples on a per server basis such that each sample corresponds to a server and a period of time over which IPFIX data in the sample corresponds. The method further includes identifying a plurality of the server samples that are labeled positive for amplification attacks. The method further includes identifying a plurality of server samples that are labeled negative for amplification attacks. The method further includes automatically labeling at least some of the remaining server samples as positive or negative based on the previously identified labeled samples. The method further includes using the automatically labeled samples to train an amplification attack detection system.