DoS Mitigation Whitelist via Persistent Client Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Denial of Service (DoS) mitigation techniques cause delays and resource overconsumption, affecting legitimate users and the provider's ability to mitigate attacks effectively.
Innovation Solution
The system identifies and prioritizes 'persistent clients' by analyzing network flow data to create a whitelist, allowing privileged access and excluding unnecessary mitigation for recognized, frequent, and legitimate IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DoS mitigation filtering and verification processes are applied to all incoming traffic, then attack mitigation effectiveness is improved, but legitimate user access speed deteriorates
Solution Approach 1:
The system performs preliminary analysis of network flow data before the DoS attack occurs to identify persistent legitimate clients. By pre-establishing a whitelist of legitimate IP addresses based on historical flow patterns, the system can quickly differentiate between legitimate and malicious traffic during an attack without requiring real-time verification of each connection, thus maintaining both security effectiveness and access speed.
2Reliability
If comprehensive DoS mitigation verification is performed on all traffic, then security against attacks is improved, but processing resources are overconsumed
Solution Approach 1:
The system segments incoming traffic into two distinct categories: whitelisted legitimate traffic and non-whitelisted traffic. Whitelisted traffic bypasses the resource-intensive verification processes entirely, while only non-whitelisted traffic undergoes comprehensive DoS mitigation checks. This segmentation dramatically reduces overall processing resource consumption while maintaining security effectiveness.
3Reliability
If DoS mitigation processes are applied to all incoming connections, then attack protection is improved, but system productivity deteriorates
Solution Approach 1:
The system performs preliminary identification of legitimate clients by analyzing historical network flow data and establishing a whitelist before the DoS attack occurs. During the attack, connections from whitelisted IPs are immediately accepted without undergoing resource-intensive verification processes, thereby maintaining high system productivity while preserving attack protection capabilities.
Solution Approach 2:
The system divides incoming traffic handling into two parallel pathways: a fast pathway for whitelisted legitimate traffic that bypasses mitigation verification, and a thorough verification pathway for non-whitelisted traffic. This segmentation enables the system to maintain high overall productivity by processing the majority of legitimate traffic efficiently while still applying comprehensive security checks where needed.
Data Source
AI summary
Embodiments relate to systems, devices, and computing-implemented methods for providing DoS mitigation using a list of persistent clients generated using network flow data. Daily flow counts can be incremented once per date for unique flow combinations in the network flow data that are associated with at least one network interaction that occurred on that date. A candidate list of persistent clients can be created based on the daily flow counts, and the candidate list of persistent clients can be filtered and ranked, and the list of persistent clients can be selected based on the rankings.