Network Security Filter Over-Mitigation Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems often inadvertently block legitimate traffic while attempting to prevent Denial of Service (DoS) attacks, leading to over-mitigation and service denial for legitimate users.
Innovation Solution
A method and system that detect and prevent over-mitigation by generating test traffic packets based on legitimate network traffic patterns, injecting them into the network security filter, and adjusting the filter settings to ensure legitimate traffic is not treated as malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network security filter is configured to be restrictive in detecting DoS attacks, then attack traffic is blocked, but legitimate traffic is also blocked (over-mitigation)
Solution Approach 1:
The system performs preliminary analysis of legitimate traffic patterns before deploying security filters. By capturing and analyzing legitimate traffic in advance, the system builds a baseline profile that prevents over-mitigation of legitimate traffic while maintaining DoS attack prevention capabilities
Solution Approach 2:
The system continuously monitors traffic patterns and provides feedback to adjust filter sensitivity. When legitimate traffic is mistakenly blocked, the system learns from this feedback and adjusts its detection parameters to prevent future over-mitigation while maintaining security
2Productivity
If network security filter is configured to be permissive, then legitimate traffic flows freely, but DoS attacks are not effectively blocked
Solution Approach 1:
The system applies different filtering criteria to different traffic characteristics. By analyzing specific packet attributes and applying localized filtering rules based on legitimate traffic patterns, the system allows legitimate traffic to flow freely while blocking DoS attacks that deviate from established patterns
Solution Approach 2:
The system dynamically adjusts detection parameters based on traffic analysis. By changing thresholds and sensitivity parameters according to observed legitimate traffic patterns, the system maintains high productivity for legitimate traffic while ensuring reliable DoS attack prevention
3Measurement precision
If traffic filtering criteria are made more specific, then DoS attack detection accuracy improves, but legitimate traffic may be misidentified as attack traffic
Solution Approach 1:
The system performs preliminary characterization of legitimate traffic before applying specific filtering criteria. By establishing baseline patterns of legitimate traffic in advance, the system can apply specific detection rules without misidentifying legitimate traffic as attacks
Solution Approach 2:
The system introduces an intermediary analysis layer that evaluates traffic against multiple criteria before classification. This intermediary process examines packet attributes, flow patterns, and behavioral characteristics to ensure accurate distinction between legitimate traffic and DoS attacks
4Reliability
If traffic monitoring and analysis is performed continuously, then over-mitigation can be detected early, but system resource consumption increases
Solution Approach 1:
The system performs traffic analysis periodically rather than continuously, sampling traffic at intervals to detect over-mitigation events. This periodic approach maintains reliable detection capability while significantly reducing computational resource consumption compared to continuous monitoring
Solution Approach 2:
The system applies full analysis only when suspicious patterns are detected, using lighter monitoring for normal traffic conditions. This partial action approach ensures reliable over-mitigation detection when needed while conserving system resources during normal operation
Data Source
AI summary
A computer method and system for detecting and preventing over-mitigation of network attacks (e.g., Denial of Service (DoS) attacks) upon a protected computer network by a network security element. A determination is made as to whether captured data packets transmitting to a protected network are associated with legitimate network traffic (e.g., non-attack traffic). A matching pattern of the captured data packets determined legitimate network traffic is generated and test traffic packets utilizing the matching pattern of the captured data packets are then generated. The generated test traffic packets are then injected into the network security element/filter. A determination is then made as to whether if the injected test traffic packets are treated as a malicious traffic (e.g., a DoS attack), or as legitimate traffic, by the network security filter. If treated as malicious traffic (e.g., the network security filter is treating legitimate traffic as malicious), indication is provided to cause changes to the network security filter to prevent legitimate traffic from being treated as malicious (e.g., attack/DoS traffic).