Entropy-Based Multi-Detector System for Low and Slow DDoS Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems are ineffective in detecting and mitigating low and slow application Distributed Denial of Service (DDoS) attacks, which are characterized by their stealthy and large-scale nature, exploiting the inability of servers to distinguish between legitimate and malicious client requests, leading to resource wastage and undetectability.
Innovation Solution
The use of Entropy measures as a metric to identify features such as client Geo IP, request time, response size, user preference, and client behavior, combined through Receiver Operating Characteristic (ROC) curves and correlation-based methods to detect and trigger countermeasures for low and slow DDoS attacks, including Geo, response size, preference, and client behavior detectors, which compare current and normal traffic profiles to raise alarms and implement mitigation strategies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional single-detector methods are used to detect DDoS attacks, then the detection system is simple, but the detection accuracy is insufficient and false positives occur frequently
Solution Approach 1:
The detection system is segmented into multiple independent detectors, each specializing in detecting specific attack patterns or traffic anomalies. Each detector processes a particular aspect of traffic analysis (e.g., packet rate, flow patterns, protocol compliance) and generates independent detection results. This segmentation allows the system to achieve high detection accuracy through specialized analysis while maintaining manageable complexity by dividing the overall detection task into modular components.
Solution Approach 2:
Multiple detector results are merged through a composition mechanism that aggregates detection outcomes from individual detectors. The merging process combines evidence from various detectors using logical operations or weighted scoring to produce a final detection decision. This combination approach amplifies the detection capability of individual detectors while filtering out false positives through cross-validation, thereby achieving high accuracy without requiring each detector to be overly complex.
2Reliability
If multiple detectors are composed to improve detection accuracy, then false positives are reduced, but the computational complexity increases
Solution Approach 1:
Detectors are configured with pre-established thresholds, rules, and parameters derived from normal traffic baselines and known attack patterns. Detection logic, decision boundaries, and composition strategies are predetermined and stored in the system configuration. This preliminary preparation allows detectors to operate reliably with simple real-time comparisons against pre-computed criteria, reducing the computational complexity of the composition process while maintaining high detection reliability.
3Adaptability or versatility
If detectors monitor multiple traffic features, then detection coverage is improved, but the processing time increases
Solution Approach 1:
Traffic feature monitoring is segmented across multiple specialized detectors, each focusing on specific traffic attributes (e.g., packet size distribution, inter-arrival times, protocol fields). This segmentation allows parallel processing of different feature sets simultaneously, improving detection coverage across multiple dimensions without sequentially processing all features, thereby minimizing processing time overhead.
Solution Approach 2:
The system monitors only the most critical and discriminative traffic features relevant to detecting low-and-slow DDoS attacks, rather than analyzing all possible traffic attributes. By selecting a focused subset of high-value features for each detector, the system achieves comprehensive detection coverage for attack patterns while avoiding the computational burden of processing excessive or redundant features, thus maintaining efficient processing times.
4Object-affected harmful factors
If the system implements comprehensive countermeasures, then attack mitigation is effective, but the impact on legitimate traffic increases
Solution Approach 1:
The detection and mitigation system implements continuous feedback loops where detection results from multiple detectors feed into a decision-making mechanism that dynamically adjusts countermeasure intensity. When attacks are detected, countermeasures are applied at optimized levels that block malicious traffic while preserving legitimate flow. The system monitors the effectiveness of countermeasures in real-time and adjusts parameters to minimize impact on productivity, ensuring that mitigation effectiveness is maintained without unnecessarily throttling legitimate traffic.
Data Source
AI summary
Methods and systems for detecting and defeating a low and slow application DDoS attack, comprising: computing the Entropy of a plurality of detectors, at least in part selected from a group Geo detector, a group response size detector, a group preference detector, and an individual client behavior detector, wherein the plurality of detectors each describe a feature of traffic affected by the DDoS attack; composing the plurality of detectors on one or more of a Receiver Operating Characteristic (ROC) curve basis and a correlation basis; and implementing a countermeasure to mitigate the DDoS attack.