Intrusion Detection System for Publish-Subscribe Network DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional publish-subscribe networks are vulnerable to denial of service (DoS) attacks due to their lack of design for handling unexpected or malicious behavior from publishers and subscribers, making it difficult to detect and mitigate such attacks effectively.
Innovation Solution
A computer-implemented method that generates indicators representing the network's state, calculates probabilities of an attack using Markov chains and weighted polynomial functions, and dispatches handlers to address detected attacks based on these probabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the network infrastructure is designed to support a large number of publishers and subscribers, then the network capacity and coverage are improved, but the vulnerability to DoS attacks increases
Solution Approach 1:
The patent introduces an intrusion detection system as an intermediary component between publishers/subscribers and the network infrastructure. This mediator monitors network traffic, generates indicators of attack, and triggers handlers to mitigate DoS attacks, thereby protecting the network capacity while reducing vulnerability to attacks.
Solution Approach 2:
The system implements continuous feedback loops where the IDS monitors network state, generates attack indicators, dispatches handlers, and adjusts its monitoring based on the current network condition. This feedback mechanism enables dynamic adaptation to ongoing attacks while maintaining network productivity.
2Device complexity
If conventional network infrastructure is used without specialized attack detection, then the system simplicity is maintained, but the ability to detect and respond to attacks deteriorates
Solution Approach 1:
The intrusion detection system is segmented into distinct functional modules: an IDS that monitors network traffic, an indicator generation component that creates attack indicators, a probability calculation module that assesses attack likelihood, and handler components that execute mitigation. This segmentation allows each component to perform its specific function efficiently while maintaining overall system manageability.
Solution Approach 2:
The system performs preliminary actions by continuously generating indicators of attack and calculating attack probabilities before actual attacks can cripple the network. The IDS proactively monitors network state and prepares mitigation handlers in advance, enabling faster response to DoS attacks.
3Stability of the object's composition
If the network infrastructure is designed for expected operation only, then the design robustness is maintained, but the adaptability to malicious behavior deteriorates
Solution Approach 1:
The system transitions from static design to dynamic operation by continuously adapting its behavior based on real-time network conditions. The IDS dynamically adjusts its monitoring focus, the probability calculation adapts to current traffic patterns, and handlers are dispatched based on real-time attack assessment, enabling the system to respond to unexpected malicious behavior while maintaining design robustness.
Solution Approach 2:
The system changes operational parameters dynamically by adjusting its attack detection thresholds, probability calculation weights, and handler selection criteria based on the current network state. This allows the system to adapt to different types of attacks and network conditions without requiring fundamental redesign.
Data Source
AI summary
A publish-subscribe network includes a network infrastructure configured to support the exchange of data. An intrusion detection system is coupled to the network infrastructure and configured to process signals received from that infrastructure in order to detect malicious attacks on the network infrastructure. The intrusion detection system includes an evaluator that generates a set of indicators based on the received signals. The evaluator models these indicators as stochastic processes, and then predicts an attack probability for each indicator based on a predicted future state of each such indicator. The evaluator combines the various attack probabilities and determines an overall attack level for the network infrastructure. Based on the attack level, the intrusion detection system dispatches a specific handler to prevent or mitigate attacks.