Network Monitoring System for DoS Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional defenses are inadequate in identifying and mitigating the growing complexity of denial of service (DoS) and distributed denial of service (DDoS) attacks, which can exhaust resources and deny legitimate requests by overwhelming network services.
Innovation Solution
A network monitoring system that passively monitors network traffic to detect atypical behavior by analyzing client requests and server responses, correlating transaction rates, and modifying network characteristics to identify and alert potential DoS attacks, utilizing a monitoring engine and analysis engine to classify traffic and raise alerts based on predefined rules and thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional defenses are used to monitor network traffic, then basic security monitoring is maintained, but they are inadequate in identifying and mitigating sophisticated DoS and DDoS attacks
Solution Approach 1:
The monitoring system is divided into multiple specialized engines: a monitoring engine that collects traffic data, an analysis engine that processes the data, and a rule engine that applies detection logic. This segmentation allows each component to specialize in specific tasks, improving overall detection accuracy while maintaining manageable complexity through modular design.
Solution Approach 2:
The patent introduces a proxy as an intermediary component that actively participates in network communication between clients and servers. The proxy intercepts, transforms, and forwards packets, enabling sophisticated analysis of traffic patterns without disrupting legitimate communications. This intermediary approach allows the system to gather detailed information for detecting sophisticated attacks while maintaining normal network operations.
2Reliability
If passive monitoring is used to avoid network participation, then network disruption is minimized, but sophisticated attack patterns cannot be effectively detected
Solution Approach 1:
The proxy acts as an intermediary that actively participates in network communication, intercepting and transforming packets between clients and servers. This allows the system to gather detailed traffic information for detecting sophisticated attack patterns while maintaining legitimate communications uninterrupted. The proxy's active participation enables deep inspection of traffic without causing network disruption.
Solution Approach 2:
The monitoring system combines multiple monitoring approaches (passive observation and active interception) into a composite solution. The system can operate in different modes depending on the situation, using passive monitoring for baseline traffic analysis and active proxy interception when sophisticated attacks are suspected, thereby achieving both low disruption and high detection capability.
3Measurement precision
If resource consumption is increased to analyze all packets in detail, then detection precision is improved, but network performance deteriorates under attack
Solution Approach 1:
The system applies partial analysis to all traffic and excessive (detailed) analysis only to suspicious packets. The monitoring engine initially processes all packets at a basic level, and only packets that trigger anomaly detection or match attack patterns undergo detailed analysis by the analysis engine. This selective approach maintains detection precision for attacks while minimizing the performance impact on network services.
Solution Approach 2:
The system implements feedback mechanisms where detection results and traffic patterns are continuously analyzed to adjust monitoring intensity. When normal traffic patterns are detected, monitoring operates at a lower intensity to minimize performance impact. When suspicious patterns emerge, the system increases analysis depth and resource allocation dynamically, ensuring high detection precision only when needed.
Data Source
AI summary
Embodiments are directed to monitoring network traffic over a network using one or more network monitoring computers. A monitoring engine may be instantiated to perform actions, including: monitoring network traffic to identify client requests provided by clients and server responses provided by servers in response to the client requests; determining request metrics associated with the client requests; and determining response metrics associated with the server responses. An analysis engine may be instantiated that performs actions, including: comparing the request metrics with the response metrics; determining atypical behavior associated with the clients based on the comparison such that the atypical behavior includes an absence of adaption by the clients to changes in the server responses; and providing alerts that may identify the clients be associated with the atypical behavior.