Edge Router DDoS Detection Using Deep Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting and mitigating Distributed Denial of Service (DDoS) attacks in computer networks are ineffective due to reliance on coarse-grained traffic statistics, built-in latency, and the need for external systems to configure routers, which fail to provide precise attack type knowledge and timely mitigation.
Innovation Solution
A method where network edge router devices store DDoS attack information, detect matching traffic, send alerts to mitigation devices, and apply traffic policing to limit excessive rates, enabling immediate mitigation actions without external notification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If coarse-grained traffic statistics are collected for DDoS attack detection, then the detection coverage is improved, but the measurement precision of attack type is degraded
Solution Approach 1:
The patent segments the DDoS attack detection process into two distinct parts: (1) coarse-grained traffic statistics collection for broad attack detection, and (2) deep packet inspection for precise attack type identification. This segmentation allows each component to specialize in its strength while working together to achieve both coverage and precision.
Solution Approach 2:
The patent introduces an intermediary mechanism (packet sampling and deep inspection module) that bridges the gap between coarse-grained statistics and fine-grained attack type detection. This intermediary performs detailed analysis on sampled packets to identify specific attack types without requiring full deep inspection of all traffic.
2Productivity
If sampling of traffic statistics is used for DDoS detection, then the processing load is reduced, but the detection latency is increased
Solution Approach 1:
The patent applies preliminary action by pre-configuring attack type signatures and patterns in the deep packet inspection module. When suspicious traffic is detected through sampling, the system has pre-loaded knowledge to immediately identify the attack type without requiring time-consuming analysis, thus reducing detection latency.
Solution Approach 2:
The patent implements skipping by directly analyzing only the sampled packets that show suspicious characteristics, rather than processing all packets sequentially. This allows the system to rush through the detection process for critical packets while maintaining overall system productivity.
3Reliability
If external systems configure routers for attack mitigation, then the system adaptability is improved, but the response time is degraded
Solution Approach 1:
The patent implements self-service by enabling the router to autonomously detect DDoS attacks and execute mitigation actions without requiring external system intervention. The router's deep packet inspection module independently identifies attack types and triggers appropriate countermeasures, achieving both reliability through proven mitigation strategies and speed through immediate local response.
Solution Approach 2:
The patent establishes a feedback loop where the router continuously monitors traffic patterns, detects attacks in real-time, and adjusts mitigation actions accordingly. This closed-loop system provides reliable adaptation to changing attack conditions while maintaining fast response times through immediate feedback-driven adjustments.
Data Source
AI summary
Detecting a Denial of Service (DoS) attack in a network by a network edge router device whereby network traffic flows from the edge router to a core router in the network. Storing DoS attack traffic information in storage associated with the edge router which receives network traffic. Determining in the edge router if a portion of the received network traffic matches at least a portion of the stored DoS attack information. Determining in the edge router an alert condition exists if a portion of the received network traffic is determined to match at least a portion of the stored DoS attack information. Send an alert signal from the edge router to an attack mitigation device if it is determined an alert condition exists causing the attack mitigation device to transition to a mitigation state for mitigating effects of a DoS attack upon the network.