Network Attack Detection via Traffic Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content delivery systems face challenges in distinguishing between legitimate and malicious network traffic, leading to difficulties in identifying and mitigating network attacks such as DDoS, which can result in either false discarding of legitimate traffic or overload of resources.
Innovation Solution
An attack detection system that evaluates traffic metrics, including entropy changes and surges, to quickly and accurately identify network attacks by using metric evaluators and attack detectors, and generates attack signatures to mitigate the attacks effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If automated systems discard data assumed to be part of network attacks, then network attack mitigation is improved, but legitimate traffic may be falsely identified and discarded
Solution Approach 1:
The system pre-calculates and stores baseline statistics for multiple traffic metrics (packet rate, byte rate, entropy, etc.) before evaluating incoming traffic. These baselines are computed from historical data and updated over time, allowing the system to quickly compare current traffic against established patterns without performing complex real-time analysis, thus reducing false positives while maintaining detection accuracy
Solution Approach 2:
The patent introduces multiple intermediary metrics (packet rate, byte rate, entropy, inter-arrival time statistics) that serve as intermediate steps between raw traffic data and attack classification. These metrics transform complex traffic patterns into comparable statistical forms, enabling more accurate differentiation between legitimate and malicious traffic through multi-dimensional analysis
2Speed
If the system quickly identifies network attacks to prevent resource overload, then system responsiveness is improved, but false identification can result in legitimate traffic being discarded
Solution Approach 1:
Baseline statistics for multiple traffic metrics are pre-computed and stored before evaluation. The system maintains historical data and pre-calculated thresholds for packet rates, byte rates, entropy values, and inter-arrival time statistics, enabling rapid comparison against current traffic without complex real-time computation, thus achieving both speed and accuracy
Solution Approach 2:
The system evaluates multiple traffic metrics simultaneously (packet rate, byte rate, entropy, inter-arrival time, standard deviation, skewness, kurtosis) rather than relying on a single indicator. This multi-metric approach provides redundant verification, where consistent anomalies across multiple metrics strengthen attack identification while reducing false positives from partial pattern matches
3Adaptability or versatility
If the content delivery system hosts content for multiple clients, then service coverage is improved, but attacks on one client can affect other non-targeted systems
Solution Approach 1:
The system segments traffic analysis by destination IP address, allowing independent evaluation of attack patterns for each hosted service. By maintaining separate baseline statistics and performing metric evaluation for each destination, the system can identify and respond to attacks targeting specific clients without affecting the operation of other non-targeted services hosted on the same infrastructure
Solution Approach 2:
The patent introduces metric evaluators that act as intermediaries between raw traffic data and attack response actions. These evaluators compute multiple traffic metrics (packet rate, byte rate, entropy, inter-arrival time statistics) and compare them against baseline values, providing a buffer that allows detailed analysis before taking mitigation actions, thus preventing premature or incorrect responses that could affect non-targeted services
Data Source
AI summary
Systems and methods are described to enable detection of network attacks in communication networks. An attack detection system receives information regarding network traffic occurring at nodes of a communication network, and analyzes the information for anomalous traffic patterns. The attack detection system can use multiple, parallel metric evaluation units programmed to detect specific types of anomalies within traffic patterns. In one instance, a metric evaluation unit is programmed to detect changes in entropy for the traffic, as distributed according to a characteristic such as source address, protocol, or country of origin. Where the entropy of a set of traffic differs from historical averages by a large amount, such as by many standard deviations, the attack detection system may flag the traffic as indicative of an attack, even when the absolute volume of traffic has not changed.