Network Flooding Detection Using Concurrent Session Counters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting and preventing flooding attacks in computer networks require significant system resources and can inadvertently increase flooding traffic, potentially dropping legitimate traffic due to the need to track and respond to every SYN packet, regardless of its legitimacy.
Innovation Solution
A system and method that processes network traffic by using a concurrent session counter and session rate counter to determine if a packet is part of a flooding attack without tracking each packet individually, allowing for the differentiation between legitimate and flooding traffic by identifying retransmitted packets and applying thresholds to detect flooding attacks with reduced resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional SYN proxy prevention technique tracks each received SYN packet to prevent flooding attacks, then flooding attack detection capability is improved, but system resource consumption (memory, CPU cycles, processing time) increases significantly
Solution Approach 1:
The patent segments the flood detection process into two stages: a fast path that processes packets without tracking (using simple counters and thresholds) and a slow path that performs detailed analysis only when flooding is suspected. This segmentation allows most legitimate traffic to pass through quickly while reserving detailed tracking resources only for potential attack scenarios.
Solution Approach 2:
Instead of tracking every packet equally, the patent applies partial tracking by using simple rate counters for all packets and reserving full tracking resources only for packets that exceed certain thresholds or exhibit suspicious patterns. This partial action approach reduces overall resource consumption while maintaining detection capability.
2Reliability
If conventional flooding prevention devices transmit SYN-ACK packet in response to every received SYN packet, then acknowledgment reliability is improved, but flooding traffic is doubled causing legitimate traffic to be dropped
Solution Approach 1:
The patent implements dynamic SYN-ACK transmission by adjusting the behavior based on current network conditions and detected traffic patterns. Rather than uniformly responding to every SYN packet, the system dynamically decides whether to transmit SYN-ACK based on rate limiting, connection state, and detected attack patterns, thereby reducing traffic amplification while maintaining reliability for legitimate connections.
Solution Approach 2:
The patent changes key parameters such as SYN-ACK transmission timing, rate limiting thresholds, and connection state requirements based on detected traffic conditions. By dynamically adjusting these parameters, the system can reduce SYN-ACK transmission during suspected attacks while maintaining normal operation during legitimate traffic conditions.
3Loss of information
If conventional methods track and respond to every SYN packet regardless of legitimacy, then comprehensive packet monitoring is improved, but network efficiency decreases due to processing overhead
Solution Approach 1:
The patent segments packet processing into fast path and slow path, where the fast path handles the majority of packets with minimal processing (maintaining monitoring completeness through counters and thresholds) while the slow path performs detailed tracking only for suspicious packets. This segmentation preserves monitoring completeness while dramatically improving network efficiency.
Solution Approach 2:
Instead of continuously tracking every packet in detail, the patent uses periodic sampling and threshold-based triggering. The system periodically checks counters and thresholds, and only initiates detailed tracking when certain conditions are met, thereby reducing continuous processing overhead while maintaining effective monitoring.
Data Source
AI summary
A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.