FPGA SYN Packet Counting for Network Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying SYN attacks in network devices are inadequate, as they often lead to network congestion and system paralysis due to the inability to accurately count and differentiate legitimate SYN packets from fake ones, resulting in incorrect determination of SYN attacks.
Innovation Solution
A method utilizing a Field Programmable Gate Array (FPGA) and high-speed hardware memory to count SYN packets, where each count entry includes a creation time, source IP address, and cumulative number, with an aging mechanism to periodically update and clear entries, ensuring accurate tracking and prevention of SYN attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the network device counts all SYN packets to identify SYN attacks, then the detection capability is improved, but the device complexity increases due to the need for FPGA and high-speed hardware memory with aging mechanisms
Solution Approach 1:
The patent segments the counting function into two parts: the FPGA handles high-speed packet arrival counting and generates count entries, while the CPU periodically traverses and processes these entries. This segmentation allows the FPGA to operate independently at high speed without burdening the CPU, thus improving measurement precision while managing device complexity through functional division.
Solution Approach 2:
The patent introduces count entries as an intermediary data structure stored in high-speed hardware memory. These entries act as a buffer between the FPGA's high-speed counting and the CPU's periodic processing, enabling accurate SYN packet tracking without requiring continuous CPU intervention, thereby balancing precision and complexity.
2Device complexity
If the network device uses a simple threshold-based SYN attack detection method, then the device complexity is reduced, but the reliability decreases due to inability to differentiate legitimate SYN packets from fake ones
Solution Approach 1:
The patent implements preliminary action by having the FPGA continuously count SYN packets and maintain count entries in high-speed hardware memory before the CPU needs to process them. This pre-computed data is ready when the CPU traverses the entries, enabling reliable attack identification through accumulated evidence rather than simple thresholds, thus improving reliability without proportionally increasing complexity.
Solution Approach 2:
The patent implements feedback through the periodic traversal mechanism where the CPU examines count entries, identifies potential SYN attacks based on cumulative patterns, and can trigger protective actions. This feedback loop allows the system to adapt to attack patterns over time, improving reliability by detecting coordinated attacks that simple threshold methods would miss.
3Speed
If the network device continuously monitors all SYN packets in real-time, then the detection speed is improved, but the loss of energy increases due to continuous FPGA and CPU operation
Solution Approach 1:
The patent applies periodic action by having the CPU traverse and process count entries at fixed time intervals rather than continuously monitoring each SYN packet. The FPGA continues high-speed counting between intervals, but the energy-intensive CPU processing occurs only periodically. This maintains detection speed through the FPGA's continuous operation while significantly reducing overall energy consumption compared to continuous full-system monitoring.
Data Source
AI summary
Methods for counting synchronization (SYN) packets to identify a SYN attack, applicable to network device, are provided. The network device includes a field programmable gate array (FPGA) for counting the total number of received SYN packets and a high-speed hardware memory connected to the FPGA. One of the methods includes: periodically traversing the count entries stored in the high-speed hardware memory, and aging any count entry for which a time difference between a current time and a creation time reaches a preset aging time interval; obtaining a first number of SYN packets and a second number of SYN packets; and updating the total number of the received SYN packets with a sum of the first number of SYN packets and the second number of SYN packets.