Mobile DDoS Source Detection Through Control-User Plane Correlation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Network monitoring systems face challenges in identifying the sources of DDoS attacks in mobile environments due to the separation of control and user plane data packets, which hinders the attribution of malicious activity to specific devices.

Innovation Solution

A system that correlates control plane and user plane data packets to identify computing devices and types involved in DDoS attacks by analyzing traffic patterns and thresholds, generating records for network operators to mitigate threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If control plane and user plane data are monitored separately, then network monitoring can be simplified, but the ability to identify DDoS attack sources is lost

Engineering Contradiction:
Improvenetwork monitoring system complexityVSAvoidDDoS source identification accuracy
Core Design Contradiction:
Device complexityVSMeasurement precision

Solution Approach 1:

The patent combines control plane data and user plane data into a unified monitoring system. The correlation engine matches control plane messages (CMAs) with corresponding user plane data packets using identifiers like IMSI, IP addresses, and port numbers, enabling comprehensive DDoS source identification while maintaining manageable system complexity through modular architecture

Inventive Principle:
Principle #5Merging (Combining)

2Measurement precision

If all network traffic data is collected and analyzed, then DDoS source detection accuracy improves, but processing time and computational resources increase

Engineering Contradiction:
Improveattack source detection accuracyVSAvoiddata processing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by establishing correlation rules and identifier mappings between control plane and user plane data before attacks occur. The correlation engine is pre-configured with matching criteria (IMSI, IP addresses, port numbers), enabling rapid real-time analysis during attacks without extensive processing delays

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent segments the network monitoring system into distinct functional modules: control plane data collection, user plane data collection, correlation engine, and analysis module. This segmentation allows parallel processing of different data types and reduces computational bottlenecks, improving both accuracy and processing speed

Inventive Principle:
Principle #1Segmentation

Data Source

PatentEP4456481B1Systems and methods for detecting the source or sources of denial of service attacks in a mobile enivornment
Publication Date: 2025.11.05 NETSCOUT SYSTEMS INC
  • EP4456481B1 patent drawingFigure 1
  • EP4456481B1 patent drawingFigure 2
  • EP4456481B1 patent drawingFigure 3

AI summary

A method for detecting the sources of distributed denial of service attacks is disclosed. Control plane signaling data and user plane data is collected using network monitoring equipment connected to a communications network. The control plane signaling data and user plane data is correlated. Amounts of traffic are calculated for individual computing devices based on the correlated data. One or more computing devices are determined based on the amounts of traffic associated with the one or more computing devices satisfying a device anomaly criterion. A record including a list of the one or more computing devices is generated.