Malicious Network Source Identification via Hop Count Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying the source of malicious messages in a multi-net environment is challenging, especially when source IP addresses are spoofed, leading to difficulties in tracing and blocking malicious traffic during denial of service attacks, which can overwhelm network resources and impact legitimate users.
Innovation Solution
A system and method that analyze routing paths and hop counts from multiple source networks to destination locations to identify the subset of source networks with the fewest intervening hops, allowing for targeted filtering to block malicious messages without relying on spoofed IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If source IP address is used to identify malicious message source, then identification is straightforward, but source IP addresses can be spoofed making identification unreliable
Solution Approach 1:
The patent introduces routing path information as an intermediary to identify the true source of malicious messages. Instead of relying directly on spoofable IP addresses, the system uses routing paths (sequence of routers and hops) as a mediator that cannot be easily forged, thereby resolving the contradiction between identification accuracy and reliability
Solution Approach 2:
The patent transitions from identifying sources using a single dimension (IP address) to using multiple dimensions (routing path, sequence of hops, router identifiers). This dimensional expansion makes spoofing significantly more difficult while maintaining identification accuracy
2Object-affected harmful factors
If filters are applied to block malicious traffic, then denial of service attacks are mitigated, but legitimate traffic may be incorrectly blocked
Solution Approach 1:
The patent segments the filtering process into two stages: first identifying candidate source networks using routing path analysis, then applying filters only to those specific candidates. This segmentation ensures that legitimate traffic from non-candidate networks is not blocked, while malicious traffic from identified sources is effectively mitigated
3Measurement precision
If all source networks are analyzed to identify malicious sources, then comprehensive identification is achieved, but system complexity and processing time increase
Solution Approach 1:
The patent applies partial action by analyzing only the routing paths of networks that are candidates for malicious activity, rather than comprehensively analyzing all source networks. The routing path information is collected and stored in advance, enabling efficient filtering without requiring complete re-analysis of all networks during an attack
Data Source
AI summary
System, method and program for identifying a subset of a multiplicity of source networks. The subset including one or more source networks which have sent messages to one of a plurality of destination locations having a same IP address. For each of the multiplicity of source networks, a determination is made whether there are fewer intervening hops from the source network to the one destination location than from the source network to other of the plurality of destination locations. If so, the source network is included in the subset. If not, the source network is not included in the subset. One application of the present invention is to identify a source of a denial of service attack. After the subset is identified, filters can be sequentially applied to block messages from respective source networks in the subset to determine which source network in the subset is sending the messages.