HTTPS Flood Detection via TCP Header Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques are ineffective in detecting and mitigating HTTPS flood attacks, which exploit encrypted communication protocols, making it difficult to distinguish between legitimate and malicious traffic, and require significant computational resources, leading to server unresponsiveness.
Innovation Solution
A method that analyzes TCP headers of ingress traffic to estimate traffic telemetries and provides rate-based and rate-invariant features to detect potential HTTPS flood attacks without decrypting the traffic, using baselines to differentiate normal behavior from anomalies, and executes mitigation actions such as traffic blocking or rate-limiting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traffic decryption is performed to detect HTTPS flood attacks, then detection accuracy is improved, but computational resources are consumed and server unresponsiveness occurs
Solution Approach 1:
The patent introduces an intermediary detection system that analyzes encrypted traffic patterns without requiring decryption. The system uses TCP header analysis and traffic telemetry as intermediaries to identify attack characteristics, eliminating the need for computationally intensive decryption operations while maintaining detection capability.
Solution Approach 2:
The patent replaces the mechanical decryption process with a statistical analysis approach. Instead of using cryptographic key pairs to decrypt traffic, the system uses pattern recognition and baseline comparison of traffic characteristics to detect floods, substituting a computationally heavy process with a lighter statistical methodology.
2Object-affected harmful factors
If conventional DoS mitigation techniques are used for HTTPS attacks, then simple attacks can be mitigated, but encrypted traffic patterns cannot be distinguished from legitimate traffic
Solution Approach 1:
The patent changes the detection parameters from content-based analysis (requiring decryption) to meta-data based analysis (TCP headers, packet sizes, timing). By transforming the analysis focus to traffic characteristics rather than payload content, the system can differentiate attack patterns from legitimate traffic without decryption.
Solution Approach 2:
The patent segments the detection process into multiple independent features: rate-based features (request volume over time), rate-invariant features (traffic patterns independent of rate), and statistical features (deviation from baseline). This segmentation allows comprehensive analysis of traffic behavior without requiring full packet decryption.
3Use of energy by stationary object
If traffic analysis is performed without decryption, then computational overhead is reduced, but detection capability for encrypted protocols is lost
Solution Approach 1:
The system performs self-service detection by analyzing traffic characteristics that are already exposed in TCP headers and packet metadata. The detection mechanism serves itself by using the inherent structure of network protocols to provide detection capabilities without requiring external decryption resources or additional computational burden on the server.
Data Source
AI summary
A method for detecting DoS attacks using an encrypted communication protocol includes estimating traffic telemetries of packets of at least ingress traffic passing over an insecure network that is directed to a protected entity by analyzing TCP headers of the packets, the packets using an encrypted version of a non-encrypted communication protocol, the packets being intended for the protected entity; providing at least one rate-based feature and at least one rate-invariant feature based on the estimated traffic telemetries, wherein the rate-based feature and the rate-invariant feature demonstrate a normal behavior of the traffic; and executing a mitigation action when a potential flood DoS attack using the encrypted communication protocol is detected by an evaluation of each of the at least one rate-based feature and the at least one rate-invariant feature with respect to respective baselines to determine whether the behavior of the ingress traffic indicates a potential flood DoS attack.