Mobile DDoS Source Detection Through Control-User Plane Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network monitoring systems face challenges in identifying the sources of DDoS attacks in mobile environments due to the separation of control and user plane data packets, which hinders the attribution of malicious activity to specific devices.
Innovation Solution
A system that correlates control plane and user plane data packets to identify computing devices and types involved in DDoS attacks by analyzing traffic patterns and thresholds, generating records for network operators to mitigate threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If control plane and user plane data are monitored separately, then network monitoring can be simplified, but the ability to identify DDoS attack sources is lost
Solution Approach 1:
The patent combines control plane data and user plane data into a unified monitoring system. The correlation engine matches control plane messages (CMAs) with corresponding user plane data packets using identifiers like IMSI, IP addresses, and port numbers, enabling comprehensive DDoS source identification while maintaining manageable system complexity through modular architecture
2Measurement precision
If all network traffic data is collected and analyzed, then DDoS source detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary actions by establishing correlation rules and identifier mappings between control plane and user plane data before attacks occur. The correlation engine is pre-configured with matching criteria (IMSI, IP addresses, port numbers), enabling rapid real-time analysis during attacks without extensive processing delays
Solution Approach 2:
The patent segments the network monitoring system into distinct functional modules: control plane data collection, user plane data collection, correlation engine, and analysis module. This segmentation allows parallel processing of different data types and reduces computational bottlenecks, improving both accuracy and processing speed
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for detecting the sources of distributed denial of service attacks is disclosed. Control plane signaling data and user plane data is collected using network monitoring equipment connected to a communications network. The control plane signaling data and user plane data is correlated. Amounts of traffic are calculated for individual computing devices based on the correlated data. One or more computing devices are determined based on the amounts of traffic associated with the one or more computing devices satisfying a device anomaly criterion. A record including a list of the one or more computing devices is generated.