Network Attack Identification via ML Classification Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting and preventing denial-of-service (DoS) attacks in data centers often lead to false negatives and burden data plane resources, necessitating improved techniques for efficient and accurate threat identification and prevention.
Innovation Solution
A method involving a classification model trained on historical network traffic statistics to identify potential targets of attacks, followed by source identification using additional security, application-level, and resource utilization statistics, with actions taken to prevent the attack, such as firewall configuration and system disconnection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional DoS attack detection methods are used, then attack detection is performed, but false negatives occur and data plane resources are burdened
Solution Approach 1:
The patent introduces a machine learning classifier as an intermediary component that processes network traffic statistics to identify DoS attacks. This classifier acts as a mediator between raw traffic data and detection decisions, reducing the burden on data plane resources while improving detection accuracy by leveraging historical attack patterns and statistical analysis.
Solution Approach 2:
The system performs preliminary analysis by collecting and analyzing network traffic statistics before making definitive attack detection decisions. By pre-processing traffic data and computing statistical features in advance, the system reduces the computational burden during critical detection phases and improves response time.
2Measurement precision
If per-connection statistics monitoring is implemented, then DoS attacks can be detected, but system resources are overburdened
Solution Approach 1:
The patent extracts only the most relevant statistical features from network traffic data for attack detection, rather than monitoring all possible per-connection statistics. By selecting and analyzing only critical metrics (such as packet rates, flow counts, and connection patterns), the system achieves high detection precision while minimizing resource consumption.
Solution Approach 2:
The system applies partial monitoring by focusing on specific traffic patterns and statistical measures that are most indicative of DoS attacks. Rather than comprehensively analyzing all connection parameters, the system concentrates computational resources on the most informative subset of statistics, achieving effective detection with reduced overhead.
Data Source
AI summary
The disclosure provides an approach for detecting and preventing attacks in a network. Embodiments include receiving network traffic statistics of a system. Embodiments include determining a set of features of the system based on the network traffic statistics. Embodiments include inputting the set of features to a classification model that has been trained using historical features associated with labels indicating whether the historical features correspond to attacks. Embodiments include receiving, as output from the classification model, an indication of whether the system is a target of an attack. Embodiments include receiving additional statistics related to the system. Embodiments include analyzing, in response to the indication that the system is the target of the attack, the additional statistics to identify a source of the attack. Embodiments include performing an action to prevent the attack based on the source of the attack.