DoS Detection Using Inverse Time Curves for Burst Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting denial of service (DoS) attacks often misflag legitimate high burst data rates as attacks, leading to improper flagging or delayed detection, as they rely on fixed thresholds that do not accommodate varying traffic patterns effectively.
Innovation Solution
Implementing a varying threshold system using inverse time curves to slow the declaration of a DoS attack near the threshold and quicken it when traffic significantly exceeds the threshold, thereby avoiding false positives during legitimate bursts of network activity, such as those caused by protocols like BACNET in Building Automation Control Systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a fixed threshold is used for detecting DoS attacks, then detection simplicity is maintained, but false positives occur during legitimate high burst data rates
Solution Approach 1:
The patent implements a dynamic threshold system where the DoS detection threshold varies over time based on learned legitimate traffic patterns. Instead of using a static fixed threshold, the system continuously adapts the threshold to accommodate legitimate burst traffic while maintaining sensitivity to actual attacks. This resolves the contradiction by making the threshold flexible rather than fixed, improving reliability without significantly complicating operation.
Solution Approach 2:
The system changes the threshold parameter dynamically based on observed traffic patterns. By modifying the threshold value according to learned behavior patterns and traffic conditions, the system can distinguish between legitimate bursts and malicious attacks more accurately. This parameter adaptation resolves the contradiction between simplicity and accuracy by automating the threshold adjustment process.
2Reliability
If the threshold is raised to avoid false positives, then legitimate bursts are accommodated, but detection of actual DoS attacks is delayed
Solution Approach 1:
The system employs feedback mechanisms where detection results and traffic patterns are continuously monitored and used to adjust the threshold dynamically. When legitimate burst patterns are identified, the threshold is raised to avoid false positives. When attack patterns are detected or suspected, the threshold is lowered to ensure timely detection. This feedback loop resolves the contradiction by making the threshold adaptive rather than statically high.
Solution Approach 2:
The system performs preliminary learning of legitimate traffic patterns before establishing detection thresholds. By pre-characterizing normal burst behavior, the system can set higher thresholds without delaying attack detection, because the threshold is already optimized based on prior knowledge of legitimate traffic. This preliminary action resolves the contradiction by preparing the system in advance with accurate baseline data.
3Reliability
If a varying threshold system is implemented to accommodate legitimate bursts, then false positives are reduced, but system complexity increases
Solution Approach 1:
The system implements self-service through automated machine learning and pattern recognition algorithms that automatically learn legitimate traffic patterns and adjust thresholds without manual intervention. The varying threshold mechanism is self-regulating, using observed traffic data to adaptively set appropriate thresholds. This automation resolves the contradiction by eliminating the need for complex manual threshold management while maintaining high detection accuracy.
Solution Approach 2:
The patent employs a universal detection framework that handles both legitimate burst traffic and DoS attacks using the same adaptive thresholding mechanism. The system is designed to be multi-functional, accommodating various traffic patterns and attack types through a single varying threshold system rather than requiring separate mechanisms for different scenarios. This universality reduces overall system complexity while maintaining accuracy.
Data Source
AI summary
Various embodiments provide systems and methods for detecting denial of service attacks using a varying threshold.