Multi-Tiered Network Filtering System for DOS Attack Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network defense systems face challenges in effectively identifying and mitigating denial of service (DOS) attacks, particularly due to the increasing number of users and the resource-intensive nature of hardware solutions like content-addressable memory (CAM) based search engines, which are expensive, power-consuming, and generate heat.
Innovation Solution
A multi-tiered filtering and policing system that receives data packets, analyzes them using no access, first access, and second access lists, and hashes them into bins for user signature matching, allowing for rate control and efficient transmission, thereby identifying and filtering out attackers while allowing legitimate users to access the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CAM hardware is used to handle increased number of users, then the ability to identify and filter users is improved, but cost, power consumption, and heat generation increase
Solution Approach 1:
The patent replaces CAM hardware (mechanical/electronic system) with software-based filtering using bit arrays and processors. The bit array structure allows efficient user identification through software operations rather than specialized hardware, reducing power consumption while maintaining reliability.
Solution Approach 2:
The patent creates a simplified copy of user identification data in bit array form, which can be efficiently processed in software. Instead of using complex CAM hardware to store and search user data, the system uses compact bit arrays that can be manipulated through software operations, achieving the same identification function with lower resource requirements.
2Measurement precision
If packet analysis is performed for each user, then attack identification accuracy is improved, but processing time increases
Solution Approach 1:
The patent segments the filtering process into multiple passes: first pass filters obviously malicious packets using simple criteria, second pass analyzes packets from suspicious sources in more detail, and third pass handles legitimate traffic. This segmentation allows most packets to be processed quickly while maintaining high accuracy for attack identification.
Solution Approach 2:
The patent applies partial analysis to most packets (checking only basic fields) and reserves full analysis for a small subset of suspicious packets. This approach achieves high attack identification accuracy by thoroughly analyzing only the packets that matter, while processing the majority of legitimate traffic with minimal overhead.
3Measurement precision
If multiple filtering passes are implemented, then attacker identification accuracy is improved, but system complexity increases
Solution Approach 1:
The patent divides the filtering system into distinct modules: bit array management module, first pass filter module, second pass filter module, and attack identification module. Each module has a specific function, making the overall complex system manageable through clear segmentation and separation of concerns.
Solution Approach 2:
The patent performs preliminary filtering in the first pass using simple criteria and bit array lookups before proceeding to more complex analysis. This preliminary action eliminates obviously malicious or legitimate traffic early, reducing the workload for subsequent filtering passes and simplifying the overall processing flow.
Data Source
AI summary
Described are computer-based methods and apparatuses, including computer program products, for identifying attackers on a network. A data packet is filtered by a multi-tiered filtering and transmission system. Data packets matching the first tier filter are discarded. Data packets matching the second tier filter are transmitted to an output module based on a criterion. Data packets in the third tier filter are hashed into bins and data packets matching an entry in the bin are transmitted to the output module based on a criterion for the bin. Data packets in the fourth tier transmission system are transmitted to the output module based on a criterion. Data packets that do not meet the criterion for transmission to the output module are transmitted to an attack identification module which analyzes the data packets to identify attacks.