Dynamic Session Rate Limiter for Network Capacity Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network services face overwhelming challenges in determining the legitimacy of new sessions during Denial-of-Service (DoS) or Internet-of-Things (IoT) botnet attacks, as they deplete resources needed to maintain established session data, leading to conventional mitigation techniques' shortcomings.
Innovation Solution
A system with a dynamic session rate limiter that assesses remaining session table capacity and inversely correlates new session rates with this capacity, preventing session table overload by limiting new sessions when capacity falls below a threshold, and resuming normal operation when capacity increases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the service establishes sessions for all incoming requests to determine legitimacy, then legitimate user sessions are maintained, but session table capacity is depleted during attacks
Solution Approach 1:
The patent applies preliminary action by establishing a baseline session table capacity before attacks occur and pre-calculating rate limit thresholds. When the session table capacity approaches these pre-determined thresholds, the system proactively limits new session requests before capacity depletion occurs. This prevents the service from being overwhelmed during attacks while still allowing legitimate sessions to be established.
Solution Approach 2:
The patent implements feedback by continuously monitoring the session table capacity and dynamically adjusting the rate of new session admissions. The system measures the current session table usage, compares it against baseline capacity, and automatically modulates incoming session requests accordingly. This closed-loop control ensures that session table capacity is maintained within safe boundaries while maximizing legitimate session throughput.
2Quantity of substance
If the service limits new sessions to preserve session table capacity, then session table overload is prevented, but legitimate user sessions may be blocked
Solution Approach 1:
The patent applies dynamics by making the session admission rate flexible and adaptive rather than fixed. The rate limiter dynamically adjusts the threshold for admitting new sessions based on real-time monitoring of session table capacity, attack patterns, and baseline performance metrics. This dynamic adjustment allows the system to be more permissive during normal conditions (allowing legitimate sessions) and more restrictive during attacks (preserving capacity).
Solution Approach 2:
The patent changes the parameter of session admission rate from a static value to a dynamic variable that responds to system conditions. By monitoring session table capacity utilization and adjusting the admission threshold accordingly, the system optimizes the balance between allowing legitimate sessions and preventing capacity exhaustion. The baseline capacity metric serves as a reference point for determining appropriate rate limit parameters.
Data Source
AI summary
Provided are methods and systems for dynamically limiting new sessions. A method for dynamically limiting new sessions may commence with initiating a dynamic session rate limiter based on predetermined criteria. The method may further include dynamically ascertaining, by the dynamic session rate limiter, a remaining session table capacity. The method may continue with dynamically limiting, by the dynamic session rate limiter, a number of new sessions according to a function selected to negatively correlate the new sessions and the remaining session table capacity.