IP Confidence Scoring for Granular DDoS Traffic Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DDoS mitigation systems lack granularity in traffic policies, relying on whitelists and blacklists that do not allow for modular address classification, leading to inefficient handling of unknown traffic and limited flexibility in differentiating between legitimate and malicious sources.
Innovation Solution
A system that determines confidence scores for client IP addresses using various data sources, including historical and current network traffic data, to apply threshold-based actions, enabling more granular control over network traffic filtering and mitigation during DDoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If whitelists and blacklists are used for DDoS mitigation, then traffic filtering is simplified, but granularity and flexibility in traffic policy is reduced
Solution Approach 1:
The patent segments the binary whitelist/blacklist approach into multiple confidence score ranges (e.g., 0-50, 51-75, 76-100), allowing different traffic policies to be applied to different segments of traffic based on their confidence levels, thereby achieving granular control while maintaining operational simplicity
Solution Approach 2:
The patent changes the parameter from binary classification (whitelist/blacklist) to a continuous confidence score parameter, enabling fine-grained differentiation of traffic policies based on confidence levels, which resolves the contradiction between simplicity and granularity
2Device complexity
If a single dynamic threshold is used to differentiate acceptable senders from rejected senders, then system complexity is reduced, but precision in traffic differentiation is limited
Solution Approach 1:
The patent divides the single threshold into multiple thresholds that create distinct confidence score ranges, allowing precise differentiation of traffic into multiple categories (e.g., accept, rate-limit, block) based on confidence levels, thereby improving precision without excessive complexity
Solution Approach 2:
The patent implements dynamic thresholds that can be adjusted based on attack patterns and network conditions, allowing the system to adapt to changing scenarios while maintaining precise traffic differentiation through multiple confidence-based decision levels
3Reliability
If all unknown or undefined traffic is disallowed, then security is improved, but legitimate traffic from unclassified sources is blocked
Solution Approach 1:
The patent changes the decision parameter from binary (allow/block) to a continuous confidence score, enabling nuanced decisions where traffic with moderate confidence scores can be rate-limited rather than completely blocked, thus maintaining security while allowing legitimate traffic from unclassified sources
Solution Approach 2:
The patent applies partial blocking through rate-limiting for traffic with intermediate confidence scores, rather than complete blocking, thereby reducing the impact on legitimate traffic while still mitigating potential attacks
Data Source
Figure 1~2
Figure 3~5
Figure 6
AI summary
A method and system to mitigate an attack over the Internet includes collecting information related to a plurality of client IP addresses from a plurality of sources and analyzing the collected information to determine confidence scores for the plurality of client IP addresses. The method and system also include receiving network traffic from the Internet and limiting network traffic from a first subset of the plurality of client IP addresses characterized by a confidence score less than a first threshold. The method, and system further include determining a level of the network traffic and limiting network traffic from a second subset of the plurality of client IP addresses characterized by a confidence score less than a second threshold greater than the first threshold.