Gateway DDoS Detection via Per-Device Request Counting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for improved early detection and prevention of Distributed Denial of Service (DDoS) attacks originating from devices within a local area network supplied by a service provider, as existing methods are inadequate in effectively blocking such attacks without disrupting legitimate service.
Innovation Solution
The method involves an access point connected to a wide area network that counts request totals per device and destination IP address, transmits alert messages when thresholds are exceeded, and blocks data communication from devices participating in DDoS attacks, using factory-preset or remotely configurable values, and configurable per destination IP address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DDoS detection methods are used, then detection capability is limited, but service disruption to legitimate users increases
Solution Approach 1:
The patent segments the DDoS detection problem by creating separate counter mechanisms: local counters at each access point for per-device monitoring, and global counters for aggregate traffic analysis. This segmentation allows localized detection without requiring complete service shutdown, resolving the contradiction between detection reliability and service availability.
Solution Approach 2:
The patent implements preliminary action by establishing threshold-based alert mechanisms that trigger before complete service disruption occurs. When local or global counters exceed predefined thresholds, alert messages are transmitted and selective blocking is applied, preventing full-scale DDoS impact while maintaining legitimate service for unaffected users.
2Object-affected harmful factors
If all devices are blocked when DDoS is detected, then attack prevention is achieved, but legitimate devices are also affected
Solution Approach 1:
The patent applies local quality by enabling selective blocking at the individual device level rather than blanket blocking of all traffic. The access point maintains local counters per device and can block only those specific devices that exceed thresholds, while allowing legitimate devices to continue operating normally. This resolves the contradiction between preventing attack impact and maintaining ease of operation for legitimate devices.
Solution Approach 2:
The patent implements feedback mechanisms where alert messages are transmitted between access points and centralized systems based on counter threshold violations. This feedback loop enables dynamic, selective blocking decisions rather than static all-or-nothing approaches, allowing the system to differentiate between malicious and legitimate traffic patterns while preventing DDoS impact.
3Measurement precision
If centralized monitoring is used, then comprehensive detection is achieved, but network communication overhead increases
Solution Approach 1:
The patent segments monitoring responsibilities between local access points and centralized systems. Each access point maintains local counters for immediate detection, reducing the need for constant centralized communication. Alert messages are only transmitted when thresholds are exceeded, significantly reducing network overhead while maintaining comprehensive detection capability through the combination of local and global monitoring.
Solution Approach 2:
The patent implements periodic action through threshold-based alert triggering rather than continuous communication. Instead of constantly reporting traffic statistics, the system periodically transmits alert messages only when counter values exceed predefined thresholds, reducing network communication overhead while maintaining precise monitoring capability through the periodic update mechanism.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Gateways (33, 34, 35) monitor communications between their LAN devices (340, 331, 352) and the WAN (31) and count the number of requests per LAN device to target IP addresses. If the number of requests for a LAN device to a target IP address exceeds a first value X, an alert message is transmitted at destination to all other gateways, the message including the target IP address. Gateways monitor the sum of request counter values based on alert messages received per target IP address. If the sum exceeds a second value VALUE_DDOS, a DDoS attack is detected. Gateways having detected a DDoS attack verify if they have a LAN device which transmitted a number of requests to the attacked IP address that exceeds value X and where appropriate puts such LAN device in quarantine by blocking data communication from the device to the WAN.