Multi-Dimensional Anomaly Detection for Selective DDoS Traffic Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDoS defense systems rely on single-dimensional analysis, leading to inaccurate and unreliable detection of anomalies in distributed network environments, often disrupting legitimate traffic while failing to differentiate between legitimate and malicious actors.
Innovation Solution
Implementing a multi-dimensional anomaly detection system that monitors system load metrics and performs multi-dimensional analysis of traffic data using security modules like tenant, IP, and connection trackers, generating adaptive anomaly scores to identify and isolate malicious traffic sources while allowing legitimate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If single-dimensional traffic analysis (e.g., requests per second) is used with static rules, then the system is simple to operate, but the anomaly detection accuracy is poor and cannot differentiate between legitimate and malicious traffic
Solution Approach 1:
The patent transitions from single-dimensional traffic analysis to multi-dimensional analysis by incorporating multiple security modules (tenant tracker, IP tracker, connection tracker) that monitor different aspects of network traffic simultaneously. This dimensional expansion enables accurate differentiation between legitimate and malicious traffic patterns without sacrificing operational simplicity.
Solution Approach 2:
The system segments traffic analysis into multiple independent security modules, each responsible for tracking specific traffic dimensions (tenant-level, IP-level, connection-level). This segmentation allows the complex multi-dimensional analysis to be broken down into manageable components while maintaining high detection accuracy.
2Reliability
If multi-dimensional analysis with multiple security modules is implemented, then the anomaly detection accuracy is improved, but the device complexity increases
Solution Approach 1:
The system divides the anomaly detection function into multiple specialized security modules (tenant tracker, IP tracker, connection tracker), each handling a specific dimension of traffic analysis. This segmentation improves reliability by ensuring comprehensive coverage of different traffic aspects while managing complexity through modular design.
Solution Approach 2:
The patent merges the outputs of multiple security modules into a unified anomaly detection decision. By combining tenant-level, IP-level, and connection-level tracking results, the system achieves high reliability in distinguishing malicious traffic from legitimate traffic while presenting a unified interface that manages operational complexity.
3Adaptability or versatility
If static rules are used for traffic filtering, then the system is easy to operate, but the adaptability to different attack patterns is poor
Solution Approach 1:
The system replaces static filtering rules with dynamic multi-dimensional analysis that automatically adapts to different attack patterns. The security modules continuously monitor traffic characteristics across multiple dimensions and adjust anomaly detection thresholds dynamically, enabling the system to respond effectively to various DDoS attack types without requiring manual rule updates.
4Object-affected harmful factors
If aggressive traffic filtering is applied to block potential threats, then the security level is improved, but the legitimate traffic flow is disrupted
Solution Approach 1:
The system applies different levels of filtering intensity to different traffic sources based on their specific characteristics. By analyzing traffic at tenant-level, IP-level, and connection-level dimensions, the system can identify and block only the malicious traffic components while allowing legitimate traffic to pass through unaffected, thus providing localized protection that preserves overall productivity.
Solution Approach 2:
The multi-dimensional tracking system continuously monitors traffic patterns and provides feedback to adjust filtering decisions in real-time. This feedback mechanism enables the system to distinguish between legitimate and malicious traffic dynamically, blocking threats while maintaining legitimate traffic flow without manual intervention.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Adaptive multi-dimensional anomaly detection is provided. System load metrics of a computing device are monitored. Multi-dimensional analysis of traffic data from a plurality of traffic sources is performed with security modules of an anomaly detector on the computing device. A traffic source is identified from the plurality of traffic sources based on the multi-dimensional analysis of traffic data from the plurality of traffic sources and associated historical traffic data. An action is performed on the traffic data from the identified traffic source, while the traffic data from the plurality of traffic sources other than the identified traffic source is allowed unaffected.