Distributed Denial of Service Detection via IP Request Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting denial of service attacks across multiple computers or clusters is challenging due to the distribution of requests, making it difficult to identify when no single computer or proxy server receives more than a predetermined threshold number of requests.
Innovation Solution
A system and method that record and total requests from source IP addresses and ranges across multiple computers, with thresholds set to detect excessive activity, allowing for automatic firewall updates or administrator notification to block malicious requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If requests are monitored on individual computers separately, then each computer can detect attacks targeting it directly, but distributed denial of service attacks across multiple computers cannot be detected
Solution Approach 1:
The patent combines monitoring data from multiple individual computers into a centralized system that aggregates request counts by source IP addresses. This merging allows the system to detect distributed denial of service attacks that would be invisible when monitoring computers separately, resolving the contradiction between individual detection precision and distributed detection coverage.
Solution Approach 2:
The monitoring system is designed to serve multiple computers simultaneously with a single unified monitoring instance. Rather than requiring separate monitoring systems for each computer, this universal approach enables the same system to detect attacks across the entire distributed network, enhancing adaptability while maintaining detection precision.
2Loss of time
If automatic firewall updates are implemented, then response time to block attacks is reduced, but system complexity and potential for false positives increase
Solution Approach 1:
The system implements feedback loops where attack detection automatically triggers firewall rule updates, which in turn affect subsequent traffic filtering. This closed-loop feedback mechanism enables rapid automated response to attacks while incorporating validation steps to reduce false positives, balancing response speed with system reliability.
Solution Approach 2:
The system performs preliminary analysis of traffic patterns before automatically updating firewall rules. By pre-establishing monitoring thresholds and validation criteria, the system can quickly respond to confirmed attacks without requiring complex real-time decision-making, reducing both response time and operational complexity.
Data Source
AI summary
System, method and computer program product for detecting a denial of service attack on a plurality of computers. Records are made of source IP addresses of requests sent to each of the computers. The records of requests sent to the plurality of computers are totalled per source IP address and/or per range of source IP addresses. A determination is made if the total for a source IP address and/or range of source IP addresses exceeds a respective, predetermined threshold. If so, a denial of service attack is suspected or determined, and a firewall can be notified to block subsequent requests from the source IP address and/or range of source IP addresses, and an administrator can be notified to investigate the situation. Records can also be made of requests sent to each of the computers for a file or access to an application. These records of requests sent to the plurality of computers are totalled per file or application access. A determination is made if the total for a file or application access exceeds a predetermined threshold. If so, a denial of service attack is suspected or determined, and an administrator can be notified to investigate the situation.