Load Balancer DOS Detection via Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DOS detection and mitigation systems are ineffective in detecting distributed Denial of Service (DOS) attacks, particularly those initiated within cloud computing systems, as they are typically located near edge routers and lack the necessary bandwidth and visibility to identify attacks targeting multiple addresses or initiated by tenants within the system.
Innovation Solution
A load balancer is placed directly in the network data packet flow path to analyze performance parameters such as packet flow, CPU usage, and protocol session disconnects, comparing them to predefined thresholds to detect DOS attacks and perform mitigation operations like blacklisting or routing adjustments to isolate affected tenant addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If DOS detection systems are located near edge routers, then device complexity is reduced, but detection precision and visibility of attacks targeting multiple addresses or initiated by tenants within the system deteriorates
Solution Approach 1:
The patent introduces a mediator component that sits between the edge router and the core network infrastructure. This intermediary position allows the system to capture and analyze traffic flows without requiring reconfiguration of existing edge router detection systems, while gaining the visibility needed to detect multi-target and internal tenant-initiated DOS attacks that would be invisible to edge-only monitoring.
2Measurement precision
If load balancer analyzes all network data packets in real-time, then detection precision improves, but processing time and computational resources increase
Solution Approach 1:
The load balancer implements partial analysis by focusing computational resources on packets that exhibit suspicious characteristics or match known attack patterns. Rather than uniformly analyzing every packet in detail, the system performs lightweight inspection on all packets and deep analysis only on those that trigger detection thresholds, significantly reducing processing time while maintaining high detection precision.
3Reliability
If load balancer isolates tenant addresses under DOS attack, then service availability for legitimate users improves, but network connectivity for affected tenants deteriorates
Solution Approach 1:
The isolation mechanism is implemented dynamically rather than statically. The load balancer continuously monitors traffic patterns to tenant addresses and adjusts routing decisions in real-time. When DOS attacks are detected, traffic is dynamically redirected away from affected addresses; when attacks subside, normal routing is automatically restored. This dynamic approach ensures service availability for legitimate users while minimizing disruption to tenants experiencing attacks.
Data Source
AI summary
A load balancer that is able to detect and mitigate a Denial of Service (DOS) attack. The load balancer is placed in the flow path of network data packets that are destined for one or more tenant addresses. The load balancer analyzes performance parameters regarding the network data packets that are destined for the one or more tenant addresses and are received at the load balancer. The performance parameters describe network data packet flow to the tenant addresses. The load balancer detects, based on the analysis of the performance parameters, that one or more of the tenant addresses are being subjected to a DOS attack. The load balancer performs a mitigation operation to isolate the one or more tenant addresses being subjected to the DOS attack.