ICMP Echo Request Filtering for Accurate Flood Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting ICMP flood attacks on servers often misclassify legitimate traffic as malicious, leading to unnecessary delays and poor user experience by simply dropping requests based on thresholds, which affects legitimate traffic.
Innovation Solution
A network traffic management system that utilizes request IDs to identify and differentiate between legitimate and malicious requests by comparing incoming echo requests with a database of previously received malicious requests, allowing only legitimate requests to be forwarded to the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a limit is set on the number of echo requests the network will receive, then the server is protected from ICMP flood attacks, but legitimate traffic is dropped along with malicious traffic resulting in unnecessary delays and poor user experience
Solution Approach 1:
The patent segments the traffic filtering process by dividing requests into two distinct groups: legitimate requests and malicious requests. This is achieved by examining request characteristics and comparing them against known malicious patterns, allowing the system to apply different actions to different segments of traffic rather than applying a blanket threshold to all requests.
Solution Approach 2:
The patent introduces an intermediary classification mechanism between the network and the server. This intermediary component analyzes incoming echo requests, compares them against stored malicious request patterns, and selectively allows or blocks requests based on their classification, thereby protecting the server without affecting legitimate traffic.
2Object-affected harmful factors
If a threshold-based request dropping mechanism is implemented, then malicious traffic is blocked, but legitimate traffic is misclassified and dropped, affecting user experience
Solution Approach 1:
The patent introduces an intermediary classification mechanism between the network and the server. This intermediary component analyzes incoming echo requests, compares them against stored malicious request patterns, and selectively allows or blocks requests based on their classification, thereby protecting the server without affecting legitimate traffic.
Solution Approach 2:
The system employs feedback by comparing incoming requests against previously identified malicious request patterns. This feedback mechanism allows the system to learn from past attacks and improve its classification accuracy over time, reducing misclassification of legitimate traffic while maintaining effective blocking of malicious requests.
Data Source
AI summary
Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with detecting a flood attack of a server includes receiving an echo request with a request id for checking connectivity to a server from a source. Next, the method determines whether the request id of the echo request matches a request id of one of a plurality of malicious received requests within a plurality of prior received requests. The comparison of the request ids is conducted to determine whether the request is a legitimate request. Then, the echo request is transmitted to the server when the comparing fails to identify the match. Lastly, an echo response can be sent to the source after sending the echo request to the server.