DoS Detection Using Benford and Zipf Distributions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting and mitigating denial of service (DoS) attacks are susceptible to packet crafting, reliant on deep packet inspection, and require specific traffic properties, making them inefficient and resource-intensive.
Innovation Solution
The method involves monitoring incoming traffic packets, building a distribution based on Benford's Law to model normal traffic behavior, detecting DoS attacks, sorting packets using Zipf's Law to differentiate between legitimate and malicious traffic, and rebuilding a distribution to allow only compliant packets to pass through, utilizing shallow packet inspection and adaptive filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to detect DoS attacks, then detection accuracy is improved, but resource consumption and processing time increase
Solution Approach 1:
The patent extracts only the essential characteristics needed for DoS detection (traffic volume, packet rate, flow patterns) rather than performing deep inspection of packet contents. This selective extraction maintains detection accuracy while significantly reducing processing resources required.
Solution Approach 2:
The detection system is segmented into multiple analysis layers: basic traffic statistics, flow pattern analysis, and behavioral modeling. Each layer processes only necessary data at its level, avoiding the need for deep packet inspection while maintaining comprehensive detection capability.
2Reliability
If traditional filtering methods are used to mitigate DoS attacks, then attack mitigation is achieved, but legitimate traffic may be blocked and detection precision decreases
Solution Approach 1:
The filtering system dynamically adjusts its behavior based on learned traffic patterns and detected attack characteristics. Rather than using static rules, the system adapts its filtering thresholds and criteria in real-time, improving precision by distinguishing legitimate traffic variations from actual attacks.
Solution Approach 2:
The system incorporates feedback loops where detection results and traffic analysis continuously refine the filtering criteria. This feedback mechanism allows the system to learn from false positives and negatives, progressively improving detection precision while maintaining reliable attack mitigation.
3Reliability
If current DoS detection methods are deployed, then attack detection capability is provided, but system complexity and implementation difficulty increase
Solution Approach 1:
The patent implements a universal detection framework that handles multiple DoS attack types (volumetric, protocol, application-layer) through a single integrated system. This multi-functional approach reduces implementation complexity by providing consistent detection mechanisms across different attack scenarios rather than requiring separate specialized systems.
Solution Approach 2:
The system performs preliminary analysis of traffic patterns and establishes baseline behavior before attacks occur. This preliminary action creates pre-configured detection rules and thresholds that simplify real-time detection during actual attacks, reducing the complexity of on-the-fly decision-making.
Data Source
AI summary
A method of detecting and mitigating a denial of service attack is described. The method comprises monitoring incoming first traffic packets, building a first Benford distribution of the first traffic packets, the first Benford distribution corresponding to network behaviour associated with normal traffic, and detecting a denial of service attack associated with incoming second traffic packets. After detecting the denial of service attack, the method involves sorting the incoming second traffic packets according to a characteristic of the incoming second traffic packets to create a Zipf distribution, building a second Benford distribution of the second traffic packets using the Zipf distribution and the first Benford distribution, discarding incoming second traffic packets that are not consistent with the second Benford distribution, and allowing incoming second traffic packets that are consistent with the second Benford distribution.