Dual NTMM Filtering for Volumetric DDoS Resource Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Volumetric distributed denial of service (DDoS) attacks pose a challenge due to the significant volume of network traffic they generate, exhausting server resources as existing mechanisms often allocate resources before determining if a connection request is from a potential bad actor.
Innovation Solution
Implementing a first and second network traffic management module (NTMM) in a connection request processing pipeline, where the first NTMM drops requests before resource allocation based on identifiers generated from the request, and the second NTMM identifies potential bad actors after resource allocation, using a list of potential bad actor identifiers and additional identifiers derived from request contents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If connection resources are allocated before determining legitimacy of connection requests, then resource allocation speed is improved, but server resources are exhausted by malicious requests
Solution Approach 1:
The system performs preliminary identification of potential bad actors using the first network traffic management module before allocating connection resources. This early detection mechanism generates identifiers from incoming requests and checks them against a list of known bad actors, allowing the system to reject malicious requests upfront while maintaining fast resource allocation for legitimate requests.
2Quantity of substance
If multiple compromised computers are used to flood targeted network, then attack volume increases, but legitimate user traffic becomes indistinguishable
Solution Approach 1:
The system segments the traffic analysis into two distinct modules: a first module that executes before resource allocation to perform initial bad actor identification using request identifiers, and a second module that executes after resource allocation for further validation. This segmentation allows the system to handle high traffic volumes efficiently by performing quick initial filtering on all requests while maintaining the ability to deeply analyze suspicious traffic.
Solution Approach 2:
The system introduces an intermediary identification mechanism that generates unique identifiers from request contents and matches them against a maintained list of potential bad actor identifiers. This intermediary layer acts as a mediator between the high-volume incoming traffic and the resource allocation system, enabling the distinction of malicious traffic from legitimate traffic even when both originate from multiple sources.
3Loss of energy
If network traffic management module executes before resource allocation, then resource waste is reduced, but system complexity increases
Solution Approach 1:
The first network traffic management module executes preliminary identification of bad actors before connection resources are allocated, generating identifiers from incoming requests and checking them against a maintained list. This preliminary action prevents resource waste by rejecting malicious requests upfront while maintaining a relatively simple architecture that can be integrated into existing network infrastructure.
Data Source
AI summary
Technologies related to mitigation of volumetric distributed denial of service attacks are disclosed. Malicious network connection request detection can be performed using a first network traffic management module (NTMM) that executes before network connection resources are allocated and a second NTMM that executes after connection resource allocation. The second NTMM can be used to determine whether a connection request is from a potential bad actor. If the request is from a potential bad actor, the second NTMM can add an identifier for the potential bad actor to a list of potential bad actors. When a subsequent connection request is received, the first NTMM can generate the identifier based on the subsequent request and determine whether it is stored in the list of potential bad actors. If it is, the first NTMM can drop the subsequent request before connection resources for establishing the second request are allocated.