False Latency Injection for Attack Source Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tier network topologies, existing security systems struggle to identify the source of attacks involving multiple connections, as they often rely on packet dropping or connection resetting, which are not sustainable and fail to trace the source effectively, especially in encrypted traffic scenarios.
Innovation Solution
A method that introduces false latency into packets of suspicious connections, allowing the propagation of attack indicators through multiple entities, enabling the identification of the attack source by analyzing latency distributions and injecting false latency into packets to track malicious payloads across east-west traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packet dropping or connection resetting is used to respond to attacks, then the attack can be stopped at its final stages, but the administrator cannot trace the attack back to the source of penetration
Solution Approach 1:
The system performs preliminary actions by injecting false latency into packets before the attack reaches its final stage. This allows the attack indicator to propagate through multiple entities and connections, enabling traceability to the source while still maintaining the ability to block the attack effectively.
Solution Approach 2:
The system uses false latency injection as an intermediary mechanism to carry attack indicators through the network. This intermediary approach allows information about the attack source to be transmitted without requiring administrators to manually filter and analyze large amounts of traffic logs.
2Measurement precision
If SIEM products correlate connections based on timestamp, then connection relationships can be identified, but this requires logging all traffic and filtering large amounts of background traffic which is resource-consuming and not sustainable
Solution Approach 1:
The system extracts only the essential timing information needed for correlation by injecting false latency into specific packets. This eliminates the need to log and filter all traffic, as only the latency-modified packets carry the attack indicator information needed for correlation.
Solution Approach 2:
The system changes the latency parameter of selected packets to encode attack indicator information. This parameter modification allows SIEM products to identify attack flows without requiring comprehensive traffic logging, as the false latency itself serves as the correlation key.
3Measurement precision
If a special signature is added in L3/L4 header or application framework, then attack identification can be achieved, but this is not practical once any node on the path establishes a new connection to the next entity
Solution Approach 1:
The false latency injection mechanism serves multiple functions simultaneously: it acts as an attack indicator, a correlation key, and a propagation signal across different network layers and entities. This universal approach works regardless of which node establishes connections, making it adaptable to multi-tier architectures.
Solution Approach 2:
The system replaces the mechanical approach of adding signatures to headers or application frameworks with a timing-based mechanism. By modifying packet latency rather than content, the system avoids the problem of signature stripping at connection nodes while maintaining attack identification capability.
Data Source
AI summary
Embodiments can provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for network protection, the method comprising determining, by the processor, if an incoming connection comprising one or more packets has a false latency larger than a trigger latency; determining, by the processor, if an attack is currently in progress; and if the attack is in progress, injecting, by the processor, at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency.