DoS Detection via Distinct Source Address Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to accurately detect and trace Denial of Service (DoS) attacks due to the ease of spoofing source addresses, leading to resource exhaustion and misidentification of regular communications as attacks, with threshold-based detection methods being sensitive to network characteristics and prone to false positives.
Innovation Solution
A system that monitors the number of distinct values in packet header fields, such as Source Address, and their ratios over time to determine unauthorized attacks, allowing for accurate detection and tracing of DoS attacks without requiring detailed settings for specific source addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If threshold-based detection methods are used to identify DoS attacks, then detection speed is improved, but detection accuracy deteriorates due to sensitivity to network characteristics and false positives
Solution Approach 1:
The patent changes the detection parameter from simple packet count thresholds to monitoring the number of distinct source address values. This parameter transformation allows the system to maintain fast detection while improving accuracy by focusing on the diversity of source addresses rather than absolute packet volumes, thereby reducing false positives caused by varying network characteristics.
2Reliability
If refusal signals are sent to each DoS packet source, then attack blocking effectiveness is improved, but system resources are exhausted due to handling multiple spoofed sources
Solution Approach 1:
The patent merges multiple DoS attack sources by monitoring the collective number of distinct source address values rather than treating each source individually. This consolidation approach maintains effective attack blocking by identifying when the total number of distinct sources exceeds thresholds, while significantly reducing resource consumption by avoiding separate handling of each spoofed address.
3Measurement precision
If source address spoofing is detected by monitoring distinct values, then attack detection accuracy is improved, but the system becomes vulnerable to legitimate traffic with diverse sources
Solution Approach 1:
The patent introduces dynamic thresholding where the thresholds for distinct source address values are not fixed but adapt based on historical traffic patterns and network characteristics. This dynamic adjustment allows the system to accommodate legitimate traffic with diverse sources while maintaining high detection accuracy for actual DoS attacks, as the thresholds automatically scale with normal traffic variability.
Data Source
AI summary
A system for detecting and tracing a (D)DoS attack and identifying the attack source, which system simplifies the judgment reference to determine whether a (D)DoS attack is present. The number of source addresses of the packets transmitted via the Internet line is monitored. When the number of the source addresses has reached a predetermined number or a predetermined ratio within a predetermined time, it is judged that an unauthorized attack is present. Moreover, where the hop number of the packet is different from a hop number corresponding to the transmission source information, the packet is judged to be malicious.