ML-Based DDoS Detection in Switches for Evolving Attack Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional signature-based detection systems for network attacks are ineffective against the evolving variability of cyberattacks, requiring continuous updates and are time-consuming and expensive, while traditional methods struggle to detect new DDOS attacks and respond effectively.
Innovation Solution
An AI/ML-based DDOS detection and mitigation solution using a hardware-accelerated security service with a DPU or switch that extracts features from network traffic and applies machine learning models to identify and mitigate DDOS attacks in real time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection systems are used for network attacks, then detection capability is provided, but the system becomes ineffective against evolving variability of cyberattacks and requires continuous updates
Solution Approach 1:
The patent replaces the mechanical signature-based detection system with an AI/ML-based detection system. The machine learning model analyzes network traffic patterns and automatically adapts to new attack types without requiring manual signature updates, thus resolving the contradiction between detection effectiveness and adaptability to evolving attacks
Solution Approach 2:
The AI/ML detection system performs self-learning and self-adjustment by continuously analyzing network traffic and updating its detection models automatically. This self-service capability eliminates the need for continuous manual updates while maintaining high detection effectiveness against evolving cyberattacks
2Reliability
If traditional detection methods are used, then system complexity is lower, but the system struggles to detect new DDOS attacks and respond effectively
Solution Approach 1:
The patent introduces an AI/ML intermediary layer between network traffic and detection decisions. This intermediary component handles the complexity of pattern recognition and attack detection, allowing the overall system to maintain high detection accuracy while managing complexity through a dedicated intelligent processing layer
3Productivity
If conventional detection systems are used, then implementation cost is lower, but the system is time-consuming and expensive to maintain
Solution Approach 1:
The AI/ML detection system operates continuously, constantly analyzing network traffic patterns and updating its models in real-time. This continuous operation enables the system to detect and respond to DDOS attacks immediately without the interruptions and delays associated with manual signature updates, thus improving productivity while reducing time loss
Data Source
AI summary
Apparatuses, systems, and techniques for detecting that a host device is subject to a distributed denial of service (DDOS) attack using a machine learning (ML) detection system are described. A computing system includes a switch with port interfaces, a central processing unit (CPU) that implements a machine learning (ML) detection system, and network monitoring logic. The network monitoring logic can extract features from network data and send the extracted features to the ML detection system. The ML detection system determines whether the host device is subject to a DDOS attack using the extracted features. The ML detection system can send an alert to the host device responsive to a determination that the host device is subject to the DDOS attack.