Dynamic IP Cyberattack Detection via Normalized TCP Timestamps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity methods struggle to differentiate between cyberattack messages and legitimate messages, especially when dynamic IP addresses are used, making it difficult to block sophisticated DDoS attacks.
Innovation Solution
A system and method that analyze TCP/IP packets for suspicious traits, extract and normalize timestamp values, and identify packets with common normalized timestamps as potentially originating from the same source host, allowing for effective blocking of subsequent packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP-based blocking methods are used to protect against DDoS attacks, then legitimate traffic can be protected, but cyberattack messages using dynamic IP addresses cannot be differentiated and blocked
Solution Approach 1:
The system performs preliminary analysis of TCP/IP packets by extracting and normalizing timestamp values before making blocking decisions. By pre-processing packet data and identifying suspicious patterns in advance, the system can differentiate attack traffic from legitimate traffic even when using dynamic IP addresses, resolving the contradiction between protection effectiveness and detection difficulty
Solution Approach 2:
The invention changes the parameter used for identification from static IP address to dynamic timestamp-based identification. By normalizing timestamp values and using them as the primary identification parameter, the system can track and block attack messages regardless of IP address changes, effectively resolving the limitation of IP-based blocking methods
2Object-affected harmful factors
If all TCP/IP packets from a source IP are blocked to prevent attacks, then attack messages are blocked, but legitimate messages from the same IP are also blocked
Solution Approach 1:
The system applies different treatment to different packets based on their timestamp characteristics rather than treating all packets from an IP address uniformly. By analyzing individual packet timestamps and comparing normalized values, the system can identify and block only suspicious packets while allowing legitimate packets to pass through, thus resolving the contradiction between blocking attacks and maintaining legitimate traffic flow
Solution Approach 2:
Instead of blocking all packets from a source IP (excessive action), the system applies partial action by selectively blocking only those packets that exhibit suspicious timestamp patterns. This approach ensures that legitimate traffic is not unnecessarily blocked while still effectively preventing attacks, resolving the contradiction between over-blocking and under-blocking
Data Source
AI summary
A system and methods of cybersecurity are provided, implementing: receiving multiple TCP/IP packets destined for a target host; determining from among the multiple TCP/IP packets, a subset of suspicious TCP/IP packets characterized by one or more suspicious traits; for each of the TCP/IP packets characterized by the one or more suspicious traits, extracting a TCP/IP timestamp header value and calculating a normalized timestamp value by subtracting a local system time from the TCP/IP timestamp header value; identifying a subgroup of the TCP/IP packets having a common normalized timestamp value indicative of generation by a common source host; receiving a subsequent TCP/IP packet destined for the target host; determining that the subsequent TCP/IP packet's normalized timestamp value is the common normalized timestamp value; and responsively blocking the subsequent TCP/IP packet from reaching the target host.