HTTPS Flood Detection Using Encrypted Traffic Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are ineffective in detecting and mitigating encrypted Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, particularly HTTPS flood attacks, due to the difficulty in distinguishing between legitimate and malicious encrypted traffic without decrypting the traffic, which consumes significant computing resources and is challenging to differentiate from normal traffic patterns.
Innovation Solution
A method and system for detecting HTTPS flood attacks by analyzing traffic features without decrypting the data, using a defense system that inspects traffic flows to identify anomalies in packet arrival times, interarrival times, and packet sizes, and generates a suspect list of IP addresses for challenge and mitigation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If decryption is performed to detect encrypted DoS/DDoS attacks, then detection accuracy is improved, but computing resources and processing time are excessively consumed
Solution Approach 1:
The patent extracts only the essential features needed for detection (packet size, interarrival time, arrival time) from the encrypted traffic without performing full decryption. This selective extraction allows detection to proceed with minimal processing overhead while avoiding the computational burden of decrypting all traffic.
Solution Approach 2:
The detection process is segmented into distinct phases: feature extraction from encrypted packets, anomaly detection using extracted features, and challenge generation for suspected attackers. This segmentation allows the system to focus computational resources only on packets that exhibit suspicious patterns rather than processing all encrypted traffic uniformly.
2Reliability
If encrypted traffic is inspected to detect HTTPS flood attacks, then security detection capability is improved, but the complexity of detection increases due to encryption
Solution Approach 1:
Instead of trying to decrypt the encrypted traffic to detect attacks, the patent inverts the approach by detecting anomalies in the encrypted traffic's metadata (timing, size patterns) directly. This inversion bypasses the encryption barrier entirely while maintaining detection effectiveness.
Solution Approach 2:
The patent introduces an intermediary detection layer that operates on encrypted traffic metadata without requiring decryption keys. This intermediary system uses machine learning models trained on encrypted traffic patterns to detect anomalies, serving as a mediator between the encrypted traffic and the security analysis.
3Measurement precision
If decryption of high volume traffic is performed, then attack detection is improved, but denial-of-service conditions may be caused by the decryption process itself
Solution Approach 1:
The patent applies partial action by performing detection on only the necessary features of encrypted packets rather than fully decrypting and analyzing all traffic. This partial processing approach provides sufficient detection capability while avoiding the excessive computational load that would cause denial-of-service conditions.
4Measurement precision
If legitimate-appearing encrypted requests are analyzed, then HTTPS flood attack detection is improved, but differentiation from valid traffic becomes more difficult
Solution Approach 1:
The patent performs preliminary analysis of traffic patterns during normal operation to establish baseline behavior. By pre-characterizing legitimate traffic patterns in terms of timing and size distributions, the system can later compare incoming traffic against these baselines to detect anomalies without needing to decrypt or deeply analyze each packet's content.
Data Source
AI summary
A system and method for detecting HTTPS flood cyber-attacks. A method includes deriving traffic features from incoming traffic directed to a protected entity; determining if the derived traffic features represent at least one traffic anomaly, wherein the traffic anomaly is a deviation from at least one baseline, wherein the baseline is a normal distribution of traffic features of legitimate incoming traffic; upon determining that the derived traffic features represent at least one anomaly, determining if the anomaly characterizes an on-going HTTPS flood cyber-attack; upon determining that there is the on-going HTTPS flood cyber-attack, populating a list of suspect source internet protocol (IP) addresses of devices triggered detection of the anomaly; challenging each device in the list of suspect source IP addresses to determine if a challenged device is an attack tool; and causing execution of a mitigation action on each client device determined to be an attack tool.