Network Strain Detection via Response Time Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for mitigating network strain, such as from DDOS attacks or spikes in traffic volume, often result in the blockage of legitimate traffic, leading to service disruptions, and there is a need for a method that can differentiate between legitimate and illegitimate traffic while maintaining online service operations.
Innovation Solution
A method that involves monitoring network traffic using a learned model to classify requests and responses based on clusters established during non-strain operation, determining response time differences, and notifying a mitigation device when thresholds are exceeded, thereby minimizing the impact on legitimate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If deep packet inspection (DPI) is used to analyze and classify traffic to block illegitimate traffic, then the ability to filter attack traffic is improved, but legitimate traffic is incorrectly blocked and service becomes unavailable
Solution Approach 1:
The system performs preliminary learning during non-strain periods to establish baseline response time characteristics for different traffic clusters. This pre-acquired knowledge is stored and later used during strain events to quickly classify and respond to traffic without needing to perform deep packet inspection in real-time, thereby avoiding legitimate traffic blockage while maintaining service availability
Solution Approach 2:
The system transitions from using deep packet inspection parameters to using response time metrics as the primary classification parameter. By measuring and comparing response times against learned baselines, the system can distinguish between legitimate and illegitimate traffic more accurately, reducing false positives that would otherwise block legitimate traffic while maintaining the ability to filter attacks
2Measurement precision
If response time metrics are used to detect network strain, then the precision of strain detection is improved, but the complexity of the monitoring system increases
Solution Approach 1:
The system performs self-learning by automatically observing network traffic patterns during non-strain periods and establishing its own baseline response time characteristics without external intervention. This self-acquired knowledge enables accurate strain detection while keeping the system architecture relatively simple, as the learning process is automated and integrated into the existing monitoring infrastructure
Solution Approach 2:
The system implements a feedback mechanism where response time measurements are continuously compared against learned baselines, and the results feed back into the classification and detection processes. This feedback loop enables precise strain detection by dynamically adjusting classifications based on deviations from normal behavior patterns, while the automated nature of the feedback reduces manual system complexity
Data Source
AI summary
The method and system are provided for monitoring a protected network for strain. The method includes receiving a learned model having clusters of learning requests of learning network traffic observed during non-strain operation of the protected network, observing network traffic, classifying each of the traffic requests with one of the clusters based on fields of the traffic request and fields used for clustering the learning requests, determining an analysis response time for respective traffic requests associated with the classified traffic requests, determining an analysis response time characteristic per cluster based on an analysis response time associated with the respective classified traffic requests classified with the cluster, determining a difference per cluster between the analysis response time and the learning response times associated with the cluster, and notifying a mitigation device when the difference determined for enough of the clusters exceeds a predetermined threshold.