Intrusion Detection Preventing Flood Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting and preventing network attacks, particularly at the application layer, are ineffective against sophisticated flood attacks that consume server resources, leading to service disruption and legitimate access denial.
Innovation Solution
An intrusion detection and prevention (IDP) device performs a three-stage analysis to monitor communication sessions, identifying and mitigating flood attacks by tracking connection rates, transaction types, and client activity, allowing for targeted action without disabling the service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional methods (disabling service or throttling access) are used to protect against flood attacks, then server protection is improved, but legitimate client access deteriorates
Solution Approach 1:
The patent segments the flood attack traffic by identifying and isolating malicious packets through pattern matching and protocol anomaly detection, allowing legitimate traffic to continue flowing while blocking only the harmful segments. This enables selective filtering that protects the server without disabling service for legitimate clients.
Solution Approach 2:
The system applies different quality treatments to different packets: malicious packets are blocked while legitimate packets are allowed through. The IDP device performs localized analysis on individual packets or flows, applying protection measures only where needed rather than globally disabling the service.
2Measurement precision
If pattern matching with multiple patterns is used to improve attack detection accuracy, then detection precision is improved, but device complexity increases
Solution Approach 1:
The patent combines multiple detection techniques including pattern matching, protocol anomaly detection, and statistical analysis into a unified IDP system. By merging these approaches, the system achieves high detection accuracy while managing complexity through integrated architecture rather than separate independent systems.
Solution Approach 2:
The IDP device performs multiple functions: it acts as a pattern matcher, protocol analyzer, statistical monitor, and traffic filter all in one system. This multi-functionality allows comprehensive attack detection without requiring multiple separate devices, thereby managing complexity while maintaining high detection precision.
3Reliability
If service is disabled or access throttled to prevent server crash, then server reliability is improved, but productivity deteriorates
Solution Approach 1:
The system extracts and removes only the malicious components (flood attack packets) from the traffic stream while leaving the legitimate service functionality intact. This selective extraction allows the server to maintain normal productivity by serving legitimate clients while being protected from attack-induced crashes.
Solution Approach 2:
The IDP device serves as an intermediary between the flood attack traffic and the server. It mediates by filtering malicious packets before they reach the server, allowing the server to maintain high productivity and service availability while still receiving protection from attacks that would otherwise cause crashes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A network security device performs a three-stage analysis of traffic to identify malicious clients. In one example, a device includes an attack detection module to, during a first stage, monitor network connections to a protected network device, during a second stage, to monitor a plurality of types of transactions for the plurality of network sessions when a parameter for the connections exceeds a connection threshold, and during a third stage, to monitor communications associated with network addresses from which transactions of the at least one of type of transactions originate when a parameter associated with the at least one type of transactions exceeds a transaction-type threshold. The device executes a programmed action with respect to at least one of the network addresses when the transactions of the at least one of the plurality of types of transactions originating from the at least one network address exceeds a client-transaction threshold.