IPsec DDoS Detection via ISAKMP Timing Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DDoS attack detection mechanisms in IPsec tunnels, such as those used in 5G networks, are not fully effective due to reliance on static threshold values and increased CPU and memory overhead, and lack dynamic detection capabilities, making them vulnerable to distributed denial of service attacks.
Innovation Solution
Implementing a deep neural network-based DDoS detection system that learns traffic patterns to dynamically assess the likelihood of DDoS attacks by analyzing ISAKMP packet time differences and other features, allowing for real-time detection and communication with the data-path for blocking offending sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a custom plugin is implemented at StrongSwan to detect DDoS attacks, then detection capability is improved, but CPU utilization and memory footprint increase
Solution Approach 1:
The patent extracts the DDoS detection logic from the main StrongSwan processing path by implementing it as a separate, dedicated plugin module. This allows the detection functionality to be isolated and executed independently, reducing the overhead on the main IPsec subsystem while maintaining detection capability.
Solution Approach 2:
The plugin performs preliminary analysis of packet characteristics and traffic patterns before the main processing occurs. By pre-calculating statistical parameters and establishing baseline behavior models in advance, the system can quickly identify anomalies without performing extensive real-time computations during active attack responses.
2Reliability
If a custom plugin is implemented at StrongSwan to detect DDoS attacks, then detection capability is improved, but memory footprint increases
Solution Approach 1:
The detection logic is extracted as a separate plugin that maintains its own dedicated data structures and memory allocations. This isolation ensures that the plugin's memory footprint is contained and does not impact the main StrongSwan memory usage, allowing for more efficient memory management.
Solution Approach 2:
The patent changes the parameters for memory management by implementing dynamic data structures that adapt their size based on actual traffic conditions. The plugin uses configurable thresholds and statistical parameters that can be adjusted to optimize memory usage while maintaining detection accuracy under varying network conditions.
3Ease of manufacture
If static/pre-configured threshold values are used for DDoS mitigation, then implementation simplicity is maintained, but dynamic detection capability is lost
Solution Approach 1:
The patent implements dynamic detection by continuously monitoring and adapting threshold values based on actual traffic patterns. The system automatically adjusts detection parameters in response to changing network conditions, moving from static pre-configured thresholds to dynamic, data-driven decision-making while maintaining ease of deployment.
Solution Approach 2:
The plugin incorporates feedback mechanisms that continuously monitor detected attack patterns and adjust detection thresholds accordingly. By analyzing the effectiveness of current detection rules and learning from actual attack behavior, the system automatically optimizes its detection capability without requiring manual reconfiguration.
4Measurement precision
If every packet is checked for impending attacks by the plugin, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent applies partial action by selectively analyzing only the most critical packet characteristics and traffic patterns rather than performing comprehensive analysis on every packet. The plugin focuses computational resources on identifying key indicators of DDoS attacks, achieving high detection accuracy while minimizing processing overhead.
Solution Approach 2:
The implementation skips unnecessary processing steps by using rapid statistical comparisons and threshold evaluations that can be performed with minimal computational overhead. The plugin employs efficient data structures and algorithms that allow quick decision-making on packet legitimacy without extensive analysis.
Data Source
AI summary
Systems and methods for detecting a Denial of Service (DoS) attack against Internet Protocol Security (IPsec) are disclosed. In one embodiment, a method comprises retrieving a first and a second Internet Security Association and Key Management Protocol (ISAKMP) packet, where the first ISAKMP packet and the second ISAKMP packet are received in immediate succession from a shared origin; storing a unique key out of a tuple wherein a value against the unique key is a time difference between the first and the second successive incoming packets; and calculating a score for each defined packet using a deep neural network, wherein a lower score value denotes an increased probability of having a DoS attack and a higher score value denotes a lower probability of a DoS attack.