ICMP Packet Filtering for DDoS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting and responding to ICMP flooding during DDoS attacks struggle to distinguish between normal user traffic and malicious traffic, often leading to the indiscriminate blocking of normal user traffic.
Innovation Solution
A method that involves receiving and analyzing ICMP packets to extract filtering information, comparing header information to determine if a packet is an attacking packet, and selectively blocking malicious traffic while allowing normal user traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional schemes measure traffic to detect and respond to attacks, then attack detection capability is improved, but normal user traffic is incorrectly blocked
Solution Approach 1:
The patent segments ICMP packets into different categories based on their header information characteristics. By analyzing specific fields in the ICMP header (such as type, code, identifier, sequence number), the system divides packets into normal user packets and attacking packets, allowing differentiated handling that prevents false blocking of legitimate traffic while maintaining attack detection capability
Solution Approach 2:
The patent applies local quality by examining specific local characteristics within ICMP packet headers rather than treating all packets uniformly. By focusing on particular header fields and their value patterns, the system can identify malicious packets with high precision while allowing normal packets with similar overall structure to pass through, thus resolving the contradiction between detection accuracy and false positive reduction
2Object-affected harmful factors
If ICMP packets are blocked indiscriminately to stop flooding attacks, then attack impact is reduced, but legitimate ICMP communication is disrupted
Solution Approach 1:
The patent introduces an intermediary filtering mechanism that sits between the incoming ICMP packets and the target system. This intermediary analyzes packet header information and makes intelligent routing decisions, allowing legitimate ICMP communication to pass through while blocking malicious flooding packets, thus protecting both the system and legitimate users without complete blocking
Solution Approach 2:
The patent changes the parameter of packet filtering from a binary block/allow decision based on simple traffic volume to a multi-parameter analysis of ICMP header fields. By evaluating multiple header parameters (type, code, identifier patterns, sequence number continuity), the system dynamically adjusts filtering behavior to permit legitimate communication while blocking attacks
Data Source
AI summary
A server receives a first echo request message which complies with an Internet control message protocol, extracts filtering information from hear information of the received first echo request message, and when a second echo request message which complies with the Internet control message protocol is received, compares header information of the received second echo request message and the extracted filtering information so as to determine whether to block an attacking packet for the received second echo request message. According to the present invention, the server blocks the attacking packet using the Internet control message protocol, thereby blocking a denial-of-service attack.