Load Balancer Aggregator Summarizer DDoS Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy load balancers fail to automatically filter or throttle cyber attacks, particularly HTTP flooding, and are inefficient in managing memory and time for calculating QPS, making them ineffective against DOS and DDOS attacks.
Innovation Solution
A system comprising a load balancer, an aggregator, and a summarizer that parses and accumulates HTTP requests as UDP messages, generates statistical data, and creates a blacklist to determine processing actions for access requests, reducing resource consumption and effectively managing traffic patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If legacy load balancer reads cookies or URL descriptions from each HTTP request to achieve traffic balancing, then traffic balance is achieved, but the system cannot automatically filter or throttle cyber attacks
Solution Approach 1:
The system segments the load balancer functionality into multiple independent modules: a statistics collection module that gathers access request data, a pattern recognition module that analyzes traffic patterns, and a throttling module that enforces rate limits. This segmentation allows each module to specialize in specific tasks, enabling attack detection without compromising traffic balancing capabilities.
Solution Approach 2:
The patent introduces an intermediary statistical analysis layer between the HTTP request processing and backend server routing. This intermediary collects statistics on access patterns, identifies potential attacks through pattern recognition, and provides throttling recommendations, thereby enabling the load balancer to detect and respond to cyber attacks while maintaining its primary traffic balancing function.
2Measurement precision
If the system records timestamp of each access with IP address, USERID and URL to calculate QPS, then access frequency analysis is achieved, but memory consumption and processing time increase significantly
Solution Approach 1:
The system performs preliminary aggregation of access statistics by grouping requests according to predefined combinations of data fields (such as IP address, URL, and time period) before detailed QPS calculation. This preliminary action reduces the volume of data that needs to be processed and stored, thereby decreasing memory consumption while maintaining measurement precision.
Solution Approach 2:
The patent dynamically adjusts the granularity and retention period of statistical data based on predefined policies. Instead of recording and storing all individual access timestamps indefinitely, the system changes parameters such as aggregation intervals and data retention periods, thereby reducing memory consumption while maintaining sufficient precision for QPS calculation and attack detection.
3Reliability
If flow cleaning technology retransmits TCP/UDP packets to protect against ICMP/TCP/UDP flooding, then protection against network layer attacks is achieved, but the system is helpless against HTTP flooding from application layer
Solution Approach 1:
The patent enhances the load balancer to perform multiple functions: it continues to provide network layer protection through packet filtering and rate limiting, while simultaneously adding application layer protection through HTTP request analysis, pattern recognition, and intelligent throttling. This multi-functionality allows the system to protect against both network layer attacks (ICMP/TCP/UDP flooding) and application layer attacks (HTTP flooding) using a unified architecture.
Data Source
AI summary
A system and method for limiting access requests. In one system, a load balancer receives an access request, parses the access request into a UDP message, and transmits the UDP message to an aggregator; the aggregator accumulates the UDP message according to a predefined combination of data fields and a predefined duration so as to produce statistical data, and sends the statistical data to a summarizer in response to a request from the summarizer; the summarizer requests the statistical data from the aggregator according to a predefined request time interval, receives the statistical data from the aggregator, generates a blacklist for the access requests according to the received statistical data and a predefined rule, and sends the blacklist to the load balancer in response to a request from the load balancer. The load balancer determines a processing action on each of the received access requests according to the current blacklist.