Dynamic Attack Detector Tuning in LLNs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting Denial of Service (DoS) attacks in Low Power and Lossy Networks (LLNs) is challenging due to resource constraints, dynamic environmental conditions, and the difficulty in distinguishing between legitimate and malicious traffic, especially in distributed DoS (DDoS) attacks.
Innovation Solution
A dynamic tuning mechanism for an attack detector in LLNs that adjusts its performance based on attack detection service level agreements (SLAs), using a voting mechanism among classifiers, where parameters such as sampling periods, number of samples, and threshold values are adjusted to optimize recall and false positive rates, ensuring effective detection of network attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a voting mechanism with multiple classifiers is used to detect network attacks, then the reliability of attack detection is improved, but the device complexity and resource consumption increase
Solution Approach 1:
The attack detection system is segmented into multiple independent classifiers, each specializing in detecting different types of network attacks. These classifiers operate in parallel and their results are combined through a voting mechanism. This segmentation allows the system to achieve high reliability through diversity while keeping each individual classifier relatively simple and resource-efficient.
Solution Approach 2:
Multiple classifier results are merged through a voting mechanism that aggregates their outputs to make a final attack detection decision. The voting mechanism combines the strengths of individual classifiers, allowing the system to achieve higher reliability than any single classifier could provide alone, while the merging process is designed to be computationally efficient.
2Measurement precision
If the sampling period is reduced to capture more network traffic patterns, then the measurement precision of attack detection is improved, but the use of energy and processing resources increases
Solution Approach 1:
The sampling period is made dynamic rather than fixed. The system adjusts the sampling interval based on network conditions, traffic patterns, and detected anomalies. During normal operation, sampling occurs at a lower rate to conserve energy. When suspicious activity is detected or network conditions change, the sampling rate increases automatically to improve detection precision, thereby balancing measurement accuracy with energy consumption.
3Reliability
If the threshold for attack detection is lowered to reduce false negatives, then the recall rate is improved, but the false positive rate increases
Solution Approach 1:
The voting mechanism acts as an intermediary between individual classifier decisions and the final attack detection outcome. Instead of relying on a single threshold decision, the voting mechanism aggregates multiple classifier opinions, allowing the system to achieve high recall by detecting attacks that individual classifiers might miss, while maintaining low false positive rates through the consensus requirement of the voting process.
4Adaptability or versatility
If more classifiers are added to the voting mechanism to improve detection coverage, then the adaptability to different attack types is improved, but the productivity and processing speed decrease
Solution Approach 1:
The system segments attack detection into multiple specialized classifiers, each optimized for detecting specific attack types. This segmentation allows the system to maintain high adaptability across different attack scenarios while keeping each classifier relatively simple and fast. The modular structure enables efficient parallel processing, mitigating the productivity loss that would otherwise result from using a single comprehensive classifier.
Data Source
AI summary
In one embodiment, a device in a network receives information regarding one or more attack detection service level agreements. The device identifies a set of attack detection classifiers as potential voters in a voting mechanism used to detect a network attack. The device determines one or more parameters for the voting mechanism based on the information regarding the one or more attack detection service level agreements. The device adjusts the voting mechanism used by the potential voters based on the one or more parameters for the voting mechanism.