Network Communication Evaluation Module for Denial of Service Attack Suppression
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures are inadequate in preventing denial of service (DOS) and distributed denial of service (DDOS) attacks, particularly from exploited connected devices, which flood targets with excessive requests, overwhelming resources and disrupting services.
Innovation Solution
Implementing a Network Communication Evaluation Module (NCEM) on computing devices and networking nodes to filter and drop packets with non-authentic source IP addresses or exceeding specified rate limits, thereby controlling packet flow and mitigating DOS attacks by enforcing rate limits on specific packet types like DNS and TCP SYN requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing network security measures are used, then basic packet filtering is provided, but DOS and DDOS attacks from exploited connected devices can still overwhelm target resources
Solution Approach 1:
The system dynamically changes the parameter of packet flow rate by implementing rate limiting mechanisms. It monitors and controls the number of packets from each source IP address, adjusting the allowable packet flow rate to prevent DOS attacks while maintaining legitimate traffic. This resolves the contradiction by transforming the static security filtering into dynamic rate-based control.
Solution Approach 2:
The patent introduces an intermediary network device (such as a router or gateway) that acts as a mediator between the source of packets and the target resource. This intermediary monitors packet flow rates, authenticates source IP addresses, and drops excessive packets before they reach the target, thereby protecting service availability without requiring changes to the target system itself.
2Productivity
If all packets are transmitted without filtering, then network traffic flow is maximized, but resource overload occurs during DOS attacks
Solution Approach 1:
The system implements dynamic parameter adjustment by setting and enforcing maximum packet flow rate thresholds. When the packet flow rate from a source IP exceeds the threshold, the system automatically drops additional packets. This resolves the contradiction by allowing high packet flow rates during normal operation while preventing resource overload when rates exceed safe thresholds.
Solution Approach 2:
The patent introduces dynamic control mechanisms that adapt packet filtering based on real-time network conditions. The system continuously monitors packet flow rates and adjusts its filtering behavior dynamically, rather than using static rules. This allows the system to maintain high productivity during normal traffic while automatically protecting resource availability during attack conditions.
3Adaptability or versatility
If packets from all source IP addresses are accepted, then network connectivity is maintained, but malicious traffic from non-authentic sources cannot be blocked
Solution Approach 1:
The patent introduces an intermediary authentication mechanism that verifies source IP addresses before allowing packets to pass through. The network device acts as a mediator that checks whether the source IP address is authentic and authorized to send traffic to the target. This resolves the contradiction by maintaining network connectivity for legitimate sources while blocking malicious traffic from non-authentic sources.
Solution Approach 2:
The system implements feedback mechanisms where the network device monitors incoming packets, identifies non-authentic source IP addresses, and adjusts its filtering rules accordingly. The system learns from traffic patterns and feedback about attack sources to improve its ability to distinguish legitimate from malicious traffic, thereby maintaining connectivity while blocking harmful sources.
Data Source
AI summary
Techniques for network traffic filtering and flow control are disclosed. Some implementations provide a network communication evaluation module (“NCEM”) that executes on a networking device, such as a gateway or router, and performs network traffic control, such as suppressing denial of service attacks or otherwise limiting packet flow. The NCEM performs packet filtering in order to identify and drop packets that are being (or are likely to be) transmitted as part of a denial of service attack. The NCEM conditionally drops packets that meet specified conditions or rules. For example, the NCEM may drop all packets that are using a nonauthentic source address. As another example, the NCEM may limit the volume of packets of a particular type, such as by limiting the number of DNS requests that are made during a specified time interval.