Dynamic Traffic Thresholds for DoS Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks rely on fixed traffic thresholds, leading to unstable service platforms due to false positives or undetected attacks, causing unnecessary resource consumption or system paralysis.
Innovation Solution
A method and device that acquire traffic data and calculate dynamic overall traffic thresholds based on historical data for different time intervals, allowing for accurate detection of attacks by comparing current traffic data with adaptive thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a fixed traffic threshold is used for attack detection, then the detection method is simple and easy to implement, but it causes false positives and undetected attacks leading to unstable service
Solution Approach 1:
The patent implements dynamic traffic thresholds that automatically adjust based on historical traffic data and time intervals. The system calculates thresholds dynamically using statistical methods (e.g., mean + standard deviation) rather than using fixed predetermined values, allowing the detection mechanism to adapt to changing traffic patterns and reduce false positives while maintaining implementation feasibility through automated calculations.
Solution Approach 2:
The patent changes the parameter of traffic threshold from a fixed value to a dynamically calculated value based on multiple factors including historical traffic data, time intervals, and statistical parameters. This parameter transformation enables the system to differentiate between normal traffic fluctuations and actual attacks, improving service stability without significantly increasing implementation complexity.
2Device complexity
If a fixed traffic threshold is used for attack detection, then the detection rule is simple, but it results in unnecessary cleaning of normal traffic and malicious consumption of resources
Solution Approach 1:
The system uses dynamic thresholds that adapt to actual traffic conditions, preventing unnecessary cleaning of normal traffic. By calculating thresholds based on historical data and statistical parameters, the system accurately identifies true attacks while allowing legitimate traffic to pass through, thereby reducing wasted computational resources on false positives.
Solution Approach 2:
The patent implements a feedback mechanism where historical traffic data is continuously analyzed to update and refine traffic thresholds. The system learns from past traffic patterns and adjusts thresholds accordingly, creating a self-optimizing detection mechanism that reduces resource consumption over time by becoming more accurate in distinguishing attacks from normal traffic.
3Ease of operation
If a fixed traffic threshold is used for attack detection, then the detection method is straightforward, but it causes undetected attacks leading to paralyzed system
Solution Approach 1:
The patent transforms the detection approach by changing from a single fixed threshold to multiple dynamic thresholds based on different time intervals and statistical parameters. This parameter change enables the system to detect attacks more accurately by comparing current traffic against historically derived thresholds that account for normal variations in traffic patterns, while maintaining operational simplicity through automated calculations.
Solution Approach 2:
The system performs preliminary analysis of historical traffic data to establish baseline thresholds before actual attack detection begins. By pre-calculating statistical parameters and establishing dynamic thresholds based on normal traffic patterns, the system is prepared to accurately detect deviations that indicate attacks, improving detection precision without complicating the actual detection operation.
Data Source
AI summary
A method of detecting a DoS/DDoS attack includes: acquiring traffic data of a preset service in a preset time period, wherein the traffic data is correspondence data between an overall traffic of the service and a time; acquiring an overall traffic threshold data of the service corresponding to different time intervals calculated according to historical traffic data of the service; wherein the larger the historical traffic data of the time interval, the larger corresponding overall traffic threshold data of the service; determining the time interval corresponding to the acquired traffic data, and finding the overall traffic threshold corresponding to the time interval according to the determined time interval; and comparing the traffic data with the found overall traffic threshold, and performing an attack detection to the service when a duration for which the traffic data keeps exceeding the overall traffic threshold exceeds a preset value.