Hierarchical Attack Detection in Low Power Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network attack detection methods face challenges in distinguishing and optimizing traffic flows, particularly in low power and lossy networks, where resources are limited, and DoS attacks are difficult to detect due to overlapping protocols used by critical and non-critical applications.
Innovation Solution
A hierarchical attack detection system using non-supervised machine learning to segregate traffic flows into attack and normal categories by aggregating metrics and employing clustering techniques to refine detection, allowing for automatic segregation and mitigation strategies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If traffic flows are aggregated for DoS detection, then detection capability is improved, but device complexity increases
Solution Approach 1:
The patent segments the attack detection system into multiple hierarchical levels: flow-level aggregation for initial detection, host-level aggregation for contextual analysis, and network-level aggregation for overall threat assessment. This segmentation allows the system to handle complexity by dividing the detection task into manageable components at different scopes, improving DoS detection capability while controlling device complexity through distributed processing.
Solution Approach 2:
The patent introduces a hierarchical dimension to attack detection by aggregating traffic data across multiple levels (flow, host, network). This dimensional approach transforms the detection problem from a single-level analysis to a multi-level framework, enabling better DoS detection while managing complexity through structured organization of detection data and processing stages.
2Measurement precision
If machine learning techniques are used for traffic segregation, then detection precision is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-training machine learning models offline using historical network data and attack patterns. The trained models are then deployed for real-time traffic classification without requiring complex online learning computations. This approach improves classification precision through sophisticated ML algorithms while reducing device complexity by performing the computationally intensive model training in advance rather than during operational time.
Solution Approach 2:
The patent uses copying by creating simplified representations of complex traffic patterns through aggregated metrics and feature vectors that capture essential characteristics without the full complexity of raw packet data. This allows machine learning models to operate on condensed data representations, improving precision through sophisticated analysis while reducing device complexity by working with summarized rather than complete data.
3Reliability
If traffic aggregation is performed for attack detection, then detection reliability is improved, but loss of information increases
Solution Approach 1:
The patent segments information aggregation by maintaining separate aggregation levels (flow-level, host-level, network-level) that preserve different types of information at appropriate granularities. Flow-level data maintains detailed packet information for immediate response, while higher levels aggregate for pattern recognition. This segmentation improves detection reliability through multi-level validation while minimizing information loss by preserving critical details at lower levels.
Solution Approach 2:
The patent applies local quality by preserving detailed traffic information locally at flow and host levels while aggregating only essential metrics at the network level. This ensures that locally critical information (such as specific flow characteristics and host behaviors) is maintained without being lost in broad network-wide aggregation, improving reliability through localized detail preservation while reducing overall information loss.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
In one embodiment, a device in a network identifies a set of traffic flow records that triggered an attack detector. The device selects a subset of the traffic flow records and calculates aggregated metrics for the subset. The device provides the aggregated metrics for the subset to the attack detector to generate an attack detection determination for the subset of traffic flow records. The device identifies one or more attack traffic flows from the set of traffic flow records based on the attack detection determination for the subset of traffic flow records.