DoS Defense via Packet Classification and Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face challenges in effectively defending against denial of service (DoS) attacks, which can disrupt multiple services on a single computer system by consuming network bandwidth and resources, leading to service disruptions and inefficiencies in resource allocation.
Innovation Solution
A method and apparatus that utilize a classifier, receive rings, and a DoS countermeasure policy to analyze and manage network packets, employing a Turing test to differentiate between legitimate and malicious traffic by forwarding packets to different temporary data structures based on their source's response, thereby prioritizing and managing network resources effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a system processes all incoming network packets without discrimination, then all traffic is handled uniformly, but legitimate traffic is slowed down by malicious packets during DoS attacks
Solution Approach 1:
The patent segments incoming network traffic into different queues based on classification results. Legitimate traffic is directed to a first queue for normal processing, while suspicious traffic is directed to a second queue for additional verification. This segmentation allows the system to process different types of traffic differently, preventing malicious packets from blocking legitimate traffic while maintaining overall system throughput.
2Measurement precision
If the system implements comprehensive packet analysis to identify malicious traffic, then attack detection accuracy improves, but processing time and system resources increase
Solution Approach 1:
The patent performs preliminary classification of incoming packets using a classifier that analyzes packet headers and characteristics to identify suspicious traffic patterns. This preliminary action filters out obviously malicious packets before they enter the main processing queue, allowing the system to maintain high detection accuracy while reducing the time required to process legitimate traffic.
Solution Approach 2:
The patent introduces an intermediary verification mechanism for suspicious packets. Instead of immediately accepting or rejecting ambiguous packets, the system places them in a separate queue for additional verification using a Turing test or other challenge-response mechanisms. This intermediary step improves detection accuracy without significantly impacting the processing time of clearly legitimate traffic.
3Reliability
If the system uses multiple data structures and classification mechanisms to filter traffic, then defense effectiveness against DoS attacks improves, but device complexity increases
Solution Approach 1:
The patent divides the network processing system into distinct modules: a classifier for initial packet analysis, multiple queues for different traffic types, and verification mechanisms for suspicious packets. Each module has a specific function, making the overall complex system manageable through clear segmentation of responsibilities.
Solution Approach 2:
The patent introduces an intermediary classification layer that sits between the network interface and the application layer. This intermediary classifier automatically analyzes packets and directs them to appropriate queues, reducing the complexity burden on application developers while maintaining effective DoS protection.
4Reliability
If the system prioritizes legitimate traffic during attacks, then service continuity is maintained, but malicious traffic may still consume some resources
Solution Approach 1:
The patent segments traffic into priority queues where legitimate traffic receives preferential treatment. By placing verified legitimate packets in a high-priority queue and suspicious packets in a low-priority queue, the system ensures service continuity for legitimate users while limiting the resources consumed by potential attackers through rate limiting or dropping of low-priority traffic.
Data Source
AI summary
A method for processing packets that includes receiving a packet from a network, analyzing the packet to obtain packet information used to determine to which temporary data structure to forward the packet, if a first list includes the packet information forwarding the packet to a first temporary data structure, and processing the packet from the first temporary data structure, and if the first list does not include the packet information forwarding the packet to a second temporary data structure, processing the packet, wherein processing the packet comprises: sending a first test to a source of the packet using the packet information, placing the packet information on the first list, if a successful response to the first test is received, and placing the packet information on a second list, if an unsuccessful response to the first test is received.