Edge Device DoS Defense via Dynamic Host Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face challenges in effectively defending against denial of service (DoS) attacks, which disrupt services by consuming network resources, as they often require overprovisioning and are costly, and existing solutions struggle with source IP address spoofing and distributed attack methods.
Innovation Solution
An edge device with a DoS countermeasure policy utilizing two lists (white and black lists) and corresponding queues, where packets are forwarded based on their information, and a Turing test is used to determine the validity of packet sources, with successful responses placed on the white list and unsuccessful ones on the black list, prioritizing processing accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If overprovisioning is deployed to handle excess loads from DoS attacks, then service reliability is improved, but system cost and resource allocation increase
Solution Approach 1:
The system performs preliminary actions by pre-configuring multiple queues (white queue, black queue, gray queue) and lists (white list, black list) before DoS attacks occur. When attacks are detected, packets are immediately directed to appropriate queues based on pre-established classification rules, enabling rapid response without requiring excessive pre-allocated resources. This resolves the contradiction by preparing defensive structures in advance while maintaining efficient resource utilization during normal operation.
Solution Approach 2:
The system implements feedback mechanisms where the attacked host sends feedback information to the edge device about packet sources. This feedback is used to dynamically update the white list and black list, allowing the system to learn from attack patterns and improve its classification accuracy over time. The feedback loop enables the system to adapt to evolving attack strategies while maintaining reliable service for legitimate traffic.
2Reliability
If traditional DoS protection methods are used, then some attack mitigation is achieved, but source IP address spoofing and distributed attack methods remain effective
Solution Approach 1:
The edge device acts as an intermediary between the network and the attacked host, performing packet classification and routing decisions before packets reach the host. By using multiple queues and lists managed at the edge device, the system can filter out spoofed packets and directed attacks before they impact the host, while allowing legitimate traffic to pass through. This intermediary approach resolves the contradiction by providing robust protection against IP spoofing without blocking legitimate traffic.
Solution Approach 2:
The system segments packet processing into distinct paths using multiple queues (white queue for legitimate traffic, black queue for known malicious traffic, gray queue for uncertain traffic). This segmentation allows the system to handle different types of packets differently, applying appropriate processing rules to each queue. The segmentation resolves the contradiction by enabling precise attack mitigation while maintaining clear traffic flow for legitimate sources.
3Speed
If packets are processed without classification, then processing speed is maintained, but resource exhaustion occurs during DoS attacks
Solution Approach 1:
The system performs preliminary classification of packets into different queues based on edge device lists and attack detection rules before full processing occurs. This preliminary action quickly identifies malicious packets and directs them to the black queue for filtering, while legitimate packets are routed to the white queue for normal processing. This resolves the contradiction by enabling rapid packet triage that prevents resource exhaustion without significantly impacting processing speed for legitimate traffic.
Solution Approach 2:
The system applies different processing qualities to different packet types by directing them to appropriate queues with different processing priorities. Critical legitimate traffic in the white queue receives high-priority processing, while suspected malicious traffic in the black queue receives filtering processing. This local quality differentiation resolves the contradiction by ensuring that resource-intensive processing is applied only where necessary, preventing resource exhaustion while maintaining speed for legitimate traffic.
Data Source
AI summary
An edge device including a first list and a second list, a first queue and a second queue configured to receive packets, wherein packet information for each of the packets forwarded to the first queue is on a first list and packet information for each of the packets forwarded to the second queue is not on the first list. The edge device is configured to, for each of the packets stored in the second queue, send a message to a host to send a first test to a source of the packet, wherein the host is operatively connected to the edge device, obtain a response to the first test from the host, place the packet information on the first list, if a successful response to the first test is received, and place the packet information on a second list, if an unsuccessful response to the first test is received.