Honeypot-Based DRDoS Traffic Filtering for ISP Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed Reflection Denial of Service (DRDoS) attacks continue to pose a significant threat to computer networks due to the inability to effectively filter out spoofed traffic, leading to bandwidth exhaustion and resource wastage for Internet Service Providers (ISPs), despite existing recommendations like RFC 2827 (BCP 38), as ISPs do not directly benefit from implementing these changes.
Innovation Solution
A system utilizing a honeypot device and a filtering module within an ISP network to detect and block DRDoS attack requests by identifying attack patterns through source IP address, destination port, and protocol command analysis, switching to a blocking mode when thresholds are met, while allowing continued monitoring of attack requests to inform firewall rule adjustments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ISPs implement traffic filtering recommendations from RFC 2827 (BCP 38), then the ability to block spoofed traffic improves, but the cost and complexity of implementation increases while ISPs do not directly benefit from the implementation
Solution Approach 1:
The patent introduces a honeypot device as an intermediary between the attack source and the ISP network. The honeypot captures and analyzes spoofed traffic, generating intelligence that is then used by filtering modules to block attack traffic. This intermediary approach allows ISPs to benefit from traffic filtering without directly implementing the complex filtering infrastructure themselves.
Solution Approach 2:
The system implements a feedback loop where the honeypot continuously monitors traffic patterns, identifies spoofed packets, and provides real-time intelligence to the filtering module. This feedback mechanism enables dynamic adjustment of filtering rules based on actual attack patterns, improving the effectiveness of spoofed traffic blocking while reducing the complexity of manual configuration.
2Reliability
If ISPs filter all incoming traffic to block DRDoS attacks, then the Quality of Service improves, but the loss of legitimate traffic increases due to false positives
Solution Approach 1:
The honeypot device performs preliminary analysis of incoming traffic before it reaches the main network. By capturing and examining traffic patterns in advance, the system can identify spoofed packets with high confidence and only block those that match confirmed attack patterns, thereby preserving legitimate traffic while maintaining QoS.
Solution Approach 2:
The filtering module applies different filtering rules to different traffic flows based on local characteristics identified by the honeypot. Rather than applying uniform filtering to all traffic, the system tailors filtering actions to specific attack patterns, ensuring that legitimate traffic is not affected while maintaining high QoS for authenticated users.
3Reliability
If the filtering module blocks all attack requests, then the protection against DRDoS attacks improves, but the ability to monitor and learn from attack patterns deteriorates
Solution Approach 1:
The system segments traffic handling into two separate paths: one for legitimate traffic monitoring through the honeypot and another for blocked attack traffic. The honeypot continues to receive and analyze a portion of traffic to maintain intelligence gathering capabilities, while the filtering module blocks confirmed attack patterns. This segmentation allows simultaneous protection and learning.
Solution Approach 2:
The honeypot acts as an intermediary that receives traffic copies for analysis while the filtering module blocks actual attack traffic. This intermediary setup enables the system to maintain monitoring capabilities without exposing the production network to attack traffic, preserving both protection effectiveness and intelligence gathering.
Data Source
AI summary
A method for reducing unwanted data traffic in a computer network due to a Distributed Reflection Denial of Service (DRDoS) attack. The method comprises operating a filtering module in a normal mode or a blocking mode to allow or block requests from being communicated within a computer network in response to data from a honeypot device in the computer network. The method allows the honeypot device to continue to monitor further attack requests that are received during the DRDoS attack.