DoS Attack Detection in Multi-Core Packet Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High-speed networks face challenges in detecting and mitigating the impact of Denial of Service (DoS) attacks, particularly due to the inability of single processing cores to handle packet arrival rates, leading to input queue congestion and packet discards that affect legitimate users, and existing systems struggle to identify and manage oversized DoS attack flows without incurring significant processing costs.
Innovation Solution
A method and apparatus that detect and discard DoS attack packets by generating hash or CRC values from packet header information, monitoring congestion levels, and switching between normal and congestion modes of operation to drop packets matching previously stored values, thereby identifying and mitigating the impact of oversized DoS attack flows in multi-core packet processing environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple processing cores are used to handle packet arrival rates, then packet processing capability is improved, but system complexity increases and congestion management becomes more difficult
Solution Approach 1:
The system segments packet processing by distributing packet flows to multiple processing cores based on packet header information (source address, destination address, ports, protocol). Each core handles a subset of flows, enabling parallel processing and improved throughput while managing complexity through automated load distribution
Solution Approach 2:
A flow classifier acts as an intermediary between packet arrival and processing cores. It receives packets, determines flow characteristics, and directs packets to appropriate cores, simplifying the overall system architecture by centralizing the decision-making logic
2Productivity
If packet flows are distributed to multiple processing cores, then packet processing throughput is improved, but detection of oversized DoS attack flows becomes more difficult
Solution Approach 1:
The system performs preliminary actions by monitoring input queues for congestion conditions before packets reach processing cores. When congestion is detected in an input queue, the system proactively identifies oversized flows and redirects them to different cores or drops them, preventing DoS attacks before they can overwhelm the system
Solution Approach 2:
The system implements feedback mechanisms where processing cores report their queue depths and congestion status back to the flow classifier. This feedback loop enables real-time detection of oversized flows and dynamic adjustment of packet routing decisions to maintain balanced load distribution
3Reliability
If congestion monitoring is implemented to detect DoS attacks, then attack detection capability is improved, but processing cost increases
Solution Approach 1:
The system applies partial monitoring by only congested input queues that exceed predefined thresholds. Rather than continuously monitoring all queues at full resolution, the system monitors queue depth and triggers detailed analysis only when congestion conditions are detected, reducing processing overhead while maintaining effective DoS detection
Data Source
AI summary
Methods and apparatus for detecting and minimizing the effects of Denial Of Service (DOS) attacks in high-speed networks in which packet processing is carried out by multiple processing cores. In one embodiment of the invention a communications method and apparatus detects and deletes denial of service attack packets in a multi-core distributed packet processing system using a lightweight DOS attack packet detection and deletion process.