Network Traffic Sampling for DOS Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current detection and mitigation solutions for Denial of Service (DOS) attacks are delayed and resource-intensive, making them ineffective in quickly identifying and responding to such attacks, especially in cloud-based networks where legitimate traffic can be mimicked.
Innovation Solution
A computer-implemented method and system that samples network traffic, determines statistically estimated features, executes heuristic algorithms to generate a confidence score indicative of a DOS attack, and compares this score with confidence thresholds to determine if mitigation actions are necessary, thereby optimizing computational resources and response time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If conventional detection solutions are used to identify DOS attacks, then detection accuracy may be maintained, but response time is delayed and computational resources are excessively consumed
Solution Approach 1:
The detection system segments the analysis process into multiple stages: initial traffic sampling, statistical feature extraction, heuristic algorithm execution, and confidence score generation. Each stage processes only necessary data portions, reducing overall computational burden while maintaining detection accuracy. The system divides traffic analysis into sampled portions rather than processing complete traffic streams.
Solution Approach 2:
The system changes parameters dynamically by adjusting sampling rates, confidence thresholds, and heuristic algorithm complexity based on current network conditions and attack detection needs. This allows the system to reduce computational resources during normal operation while rapidly escalating analysis depth when potential attacks are detected, thereby reducing response time without constant high resource consumption.
2Ease of operation
If simple blacklisting of IP addresses is implemented, then ease of operation is improved, but reliability decreases due to blocking legitimate devices and inability to handle large numbers of attacking IPs
Solution Approach 1:
The system introduces statistical feature extraction and heuristic algorithms as intermediary analysis layers between raw traffic data and mitigation actions. Instead of directly blacklisting IPs, the system first analyzes traffic patterns, generates confidence scores through multiple algorithms, and only then applies mitigation. This intermediary process ensures legitimate traffic is not mistakenly blocked while maintaining operational simplicity through automated decision-making.
Solution Approach 2:
The system implements feedback mechanisms where detection results, confidence scores, and mitigation outcomes are continuously monitored and used to adjust detection parameters and blacklisting strategies. This feedback loop improves reliability by learning from false positives and negatives, refining the distinction between legitimate and malicious traffic patterns over time, while keeping the system easy to operate through automated adaptation.
3Measurement precision
If high computational resource algorithms are used to differentiate DOS attacks from legitimate traffic, then measurement precision is improved, but productivity decreases due to slow processing speed
Solution Approach 1:
The system applies partial analysis to most traffic and excessive (full) analysis only to suspicious traffic. Heuristic algorithms are executed with varying depths based on initial screening results - low-rate attacks receive more intensive analysis while high-rate attacks are processed through optimized pathways. This selective approach maintains high measurement precision for attack differentiation while preserving overall processing speed by not applying maximum computational resources to every packet.
Solution Approach 2:
The system dynamically adjusts algorithm execution based on real-time conditions, traffic patterns, and detected attack characteristics. Processing depth, sampling rates, and heuristic algorithm selection change dynamically rather than remaining static. This allows the system to maximize processing speed during normal operation while automatically increasing measurement precision when attacks are detected, resolving the contradiction between speed and accuracy through adaptive behavior.
Data Source
AI summary
Method and system for detecting a Denial-of-Service (DOS) attack on a network. The method includes sampling a traffic carried by the network between data processing devices, the traffic comprising data packets transmitted between the data processing devices, determining statistically estimated features of the traffic based on the sampling thereof, executing one or more heuristic algorithm based on the statistically estimated features, the one or more heuristic algorithms being configured to generate a confidence score indicative of a probability that at least some of the data packets constitute a DOS attack and comparing the confidence score with a confidence threshold to determine whether a mitigation order is to be generated.