Monitoring Server DoS Detection via Unsolicited Response Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to effectively detect denial-of-service (DoS) attacks, particularly SYN flooding, which overwhelm servers by sending forged SYN-ACK packets to incorrect addresses, leading to resource exhaustion and service denial.
Innovation Solution
A monitoring server is deployed to receive data packets from a target server and issue a warning signal upon receiving unsolicited response packets, which indicates a forged response address, thereby detecting DoS attacks by monitoring multiple network addresses and using a packet filter to identify unsolicited responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the monitoring server monitors a larger address space with more network addresses, then the probability of detecting forged response addresses increases, but the device complexity and resource requirements increase
Solution Approach 1:
The monitoring server divides the large address space into multiple smaller subnets or address ranges. Each subnet is monitored independently, allowing the system to handle large address spaces by processing them in manageable segments rather than as a single overwhelming task.
Solution Approach 2:
The monitoring server pre-assigns multiple response network addresses to itself before the attack occurs. This preliminary preparation ensures that when forged SYN-ACK packets arrive, there are already available addresses to compare against, enabling immediate detection without requiring dynamic address allocation during the attack.
2Reliability
If the monitoring server monitors multiple network addresses, then the probability of capturing forged source addresses increases, but the use of energy and computational resources increases
Solution Approach 1:
The monitoring server monitors more addresses than strictly necessary for minimal protection, assigning itself a pool of response addresses that exceeds the immediate needs. This excessive monitoring capacity ensures high detection probability while the server only processes packets relevant to its assigned addresses, balancing thorough monitoring with efficient resource utilization.
Solution Approach 2:
The monitoring server uses its own assigned response network addresses as the basis for detection, turning its necessary operational addresses into a detection resource. By monitoring addresses it already needs for legitimate operations, the server detects attacks without requiring separate dedicated monitoring resources.
3Productivity
If the monitoring server issues warning signals for unsolicited response packets, then the detection of DoS attacks is enabled, but the device complexity increases due to packet filtering and analysis requirements
Solution Approach 1:
The monitoring server extracts only the essential detection logic from complex packet analysis - specifically comparing the source address of incoming packets against its assigned response addresses. This extraction of the core detection function simplifies the overall system while maintaining effective attack detection capability.
Solution Approach 2:
Instead of analyzing all incoming packets for signs of attacks, the monitoring server inverts the approach by only expecting and validating packets from its assigned response addresses. Any packet not matching this expected pattern is immediately flagged as suspicious, simplifying the detection logic from complex analysis to simple pattern matching.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method (800) for detecting a denial-of-service attack, wherein the method (800) comprises the following steps: receiving (801) a data packet originating from a target server (103) by a monitoring server (301) to which a response network address is assigned; and issuing (802) a warning signal (402) by the monitoring server (301) if the received data packet is an unsolicited response packet received by the monitoring server (301).