Network Traffic Analysis Device for Small-Scale DDoS Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic analysis methods, such as Category Transform, struggle to detect small-scale DDoS attacks and specific applications like WINNY, which use few addresses, due to their comprehensive packet observation approach, leading to potential undetection during high network loads.
Innovation Solution
A device and system that classify packets into types based on protocol and port numbers, observing distinct values in packet headers and payloads, and applying Category Transform to each group to detect abnormal network conditions by crossing pre-specified ratio-thresholds within time intervals, allowing for precise detection of DDoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive packet observation is employed to detect DDoS attacks, then detection coverage is improved, but detection accuracy for small-scale attacks deteriorates due to high network loads masking the attacks
Solution Approach 1:
The patent segments the comprehensive packet observation into application-specific groups by classifying packets according to application types (e.g., HTTP, FTP, SMTP). This segmentation allows the system to apply Category Transform separately to each application group, thereby improving detection accuracy for small-scale attacks within specific applications without being masked by overall high network loads. The segmentation enables focused analysis on each application's traffic patterns while maintaining comprehensive coverage across all applications.
2Reliability
If Category Transform is applied to all packets comprehensively, then overall attack detection is improved, but small-scale attacks using few addresses remain undetected
Solution Approach 1:
The patent applies local quality by tailoring the Category Transform analysis to each application type's specific characteristics. Instead of applying a uniform analysis to all packets, the system adjusts the observation parameters and thresholds according to each application's typical traffic patterns. This allows the detection mechanism to be optimized locally for each application, thereby detecting small-scale attacks that would otherwise remain undetected in a comprehensive analysis.
3Measurement precision
If packet classification into application types is implemented, then detection precision for specific attacks is improved, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-defining application type categories and their corresponding observation parameters before actual traffic analysis begins. The system prepares the classification framework in advance, establishing the structure for segmenting packets by application type. This preliminary preparation reduces the complexity during runtime, as the classification and analysis processes follow pre-established rules and parameters rather than requiring complex real-time decision-making.
Data Source
AI summary
A system detects the presence of illegal access attacks. The device for analyzing and diagnosing network traffic divides packets into k (k>0) types based on protocol type and port number, etc., a component observing the number of distinct values of one or more pre-specified fields in packet header for each packet type, for all packets that have transited the observation points in a network, an element observing the number of distinct values of one or more pre-specified fields in the packet payload for each packet type, for all packets that have transited the observation points in a network, and a diagnosis element determining whether the network is abnormal when the number of distinct values observed in fields of each packet type crosses a specified ratio-threshold within a predetermined interval. This enables detection of small-scale DoS attacks with little change in addresses number, improving illegal access detection accuracy.