Dynamic Traffic Flow Bucket Allocation for DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems are vulnerable to denial of service (DoS) attacks, which overwhelm resources by flooding traffic, making it difficult to identify and mitigate the source of the attack due to static bucket allocation that can lead to memory exhaustion.
Innovation Solution
A method that dynamically adjusts the number of buckets for traffic flow monitoring using a hash function, allowing for dynamic division or combination of buckets based on thresholds, enabling efficient identification of attack sources and preventing resource exhaustion by varying the granularity of monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a large number of buckets are allocated to monitor all traffic flows, then measurement precision is improved, but device complexity and memory consumption increase
Solution Approach 1:
The patent implements dynamic bucket allocation where the number and granularity of buckets are adjusted based on current network conditions and traffic patterns. The system transitions from static to dynamic bucket management, allowing the monitoring structure to adapt its complexity to actual needs rather than maintaining fixed high granularity at all times.
Solution Approach 2:
Different buckets are allocated with different granularities based on local traffic characteristics. High-traffic flows receive finer-grained monitoring with more buckets, while low-traffic flows use coarser-grained monitoring with fewer buckets. This local adaptation optimizes measurement precision where needed while reducing overall system complexity.
2Device complexity
If static bucket allocation is used for traffic monitoring, then device complexity is reduced, but reliability decreases under DoS attacks
Solution Approach 1:
The system employs dynamic bucket allocation that responds to changing network conditions and attack patterns. During normal operation, the system uses fewer buckets to maintain simplicity. When a DoS attack is detected, the system dynamically increases bucket granularity to better distinguish malicious traffic, thereby maintaining reliability without permanently increasing complexity.
Solution Approach 2:
The patent changes the parameter of bucket number and granularity based on detected traffic patterns and attack conditions. By dynamically adjusting these parameters, the system maintains reliability under DoS attacks while avoiding the permanent complexity overhead of static high-granularity allocation.
3Measurement precision
If fine-grained bucket allocation is used to identify attack sources, then measurement precision is improved, but memory consumption increases
Solution Approach 1:
The patent segments the monitoring space into hierarchical levels of granularity. Instead of allocating fine-grained buckets to all traffic, the system segments monitoring into coarse-grained buckets for general traffic and fine-grained buckets only for suspicious or high-traffic flows. This segmentation reduces overall memory consumption while maintaining precision where needed for attack identification.
Solution Approach 2:
Fine-grained bucket allocation is applied locally only to traffic flows that require detailed monitoring, such as suspected attack sources or high-volume flows. The majority of traffic uses coarser-grained buckets, significantly reducing total memory consumption while maintaining the ability to precisely identify attack sources when necessary.
Data Source
AI summary
A system architecture for thwarting denial of service attacks on a victim data center is described. The system includes a first plurality of monitors that monitor network traffic flow through the network. The first plurality of monitors is disposed at a second plurality of points in the network. The system includes a central controller that receives data from the plurality of monitors, over a hardened, redundant network. The central controller analyzes network traffic statistics to identify malicious network traffic. In some embodiments of the system, a gateway device is disposed to pass network packets between the network and the victim site. The gateway is disposed to protect the victim site, and is coupled to the control center by the redundant hardened network.