DOS Attack Prevention via Dynamic Idle Timeout Adjustment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for preventing Denial of Service (DOS) attacks in networking devices are ineffective in expeditiously removing attack vectors, leading to resource exhaustion and unavailability of networking devices for authorized users, as they rely on blocking requests from changing attacker locations and may mistakenly block authorized users with high request volumes.
Innovation Solution
Implementing a method that monitors half-open sessions, identifies and removes the oldest attack vectors, and dynamically adjusts the idle timeout to expedite the removal of attack vectors by setting low and high threshold values, thereby preventing resource exhaustion and ensuring network availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional firewall blocking is used to prevent DOS attacks, then requests from identified attackers are blocked, but the system cannot expeditiously remove attack vectors and may mistakenly block authorized users with high request volumes
Solution Approach 1:
The patent implements dynamic threshold adjustment for idle timeout values based on the number of half-open sessions. When the count exceeds a high threshold, the system reduces the idle timeout value to expedite session termination. This dynamic adaptation allows the system to respond to DOS attacks by accelerating resource cleanup without permanently affecting legitimate traffic handling capabilities
Solution Approach 2:
The system changes the idle timeout parameter value based on system state. Normally, a standard idle timeout value is used. When DOS conditions are detected (high number of half-open sessions), the timeout value is reduced to a lower threshold, causing faster termination of half-open sessions and freeing up resources more quickly
2Reliability
If the networking device waits for the complete idle timeout period before terminating half-open sessions, then legitimate sessions are not prematurely terminated, but resources are exhausted during DOS attacks
Solution Approach 1:
The system continuously monitors the number of half-open sessions and uses this feedback to adjust the idle timeout value. When the count exceeds the high threshold, the system reduces the timeout value, creating a feedback loop that accelerates resource cleanup during DOS attacks while maintaining normal operation under typical conditions
Solution Approach 2:
The idle timeout value transitions from a static parameter to a dynamic one that adjusts based on system load. The system adapts the timeout duration in real-time, using lower thresholds during high-load DOS conditions and normal thresholds during typical operation, optimizing both resource availability and session accuracy
3Productivity
If the attacker sends attack vectors faster than the networking device can terminate them, then all resources are consumed and further connections are restricted, but conventional blocking methods cannot keep up with changing attacker locations
Solution Approach 1:
The patent extracts and removes the oldest half-open sessions from the system when DOS conditions are detected. By identifying and terminating these sessions, the system frees up resources (memory and CPU) that would otherwise be consumed by the attack vectors, enabling the system to handle new legitimate connections
Data Source
AI summary
A method, system and apparatus for preventing Denial of Service (DOS) attacks on a device are provided. The method includes determining that the device is receiving DOS attack vectors. The method further includes identifying the attack vector with the highest idle time and removing the identified attack vector. Further, the method includes repeating identifying and removing the identified attack vector until the number of attack vectors falls below a threshold value.