Network Traffic Detection Using Segmented Evaluator Scores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in detecting and mitigating Application Layer DDoS attacks, as they often resemble legitimate traffic, making it difficult to distinguish between malicious and legitimate connection requests, thereby requiring significant manual effort.
Innovation Solution
A system and method that analyzes network traffic using multiple 'evaluator' elements to determine a combined score, which is compared against predefined limits to detect stealthy DDoS attacks, and employs mitigation techniques upon detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing systems analyze network traffic to detect DDoS attacks, then attack detection capability is improved, but false positives increase because attack traffic resembles legitimate traffic
Solution Approach 1:
The detection system segments the analysis into multiple independent evaluator elements, each examining specific traffic characteristics. By dividing the detection task into separate evaluators that assess different aspects of traffic behavior, the system achieves more precise attack identification while reducing false positives through specialized analysis of individual traffic features
Solution Approach 2:
The system dynamically adjusts detection parameters and thresholds based on learned traffic patterns and attack characteristics. By changing evaluation parameters adaptively rather than using fixed thresholds, the system maintains high detection accuracy while minimizing false positives through parameter optimization tailored to specific attack scenarios
2Measurement precision
If multiple evaluator elements are used to analyze traffic, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The complex detection system is segmented into modular evaluator elements, each responsible for specific analysis tasks. This segmentation allows the system to achieve high detection accuracy through comprehensive multi-faceted analysis while managing complexity through organized, independent modules that can be developed and maintained separately
Solution Approach 2:
Multiple evaluator elements are merged into a unified detection framework that aggregates their individual assessments. By combining the results of several specialized evaluators through a coordinated scoring mechanism, the system achieves enhanced detection accuracy while presenting a simplified unified interface that manages the underlying complexity
3Measurement precision
If manual analysis is performed to distinguish legitimate from malicious traffic, then detection precision is improved, but productivity decreases due to significant manual effort required
Solution Approach 1:
The detection system performs self-service by automatically executing multiple evaluator elements and aggregating their results without requiring manual intervention. This automation maintains high detection precision through comprehensive analysis while dramatically improving productivity by eliminating time-consuming manual review processes
Solution Approach 2:
The system incorporates feedback mechanisms where detection results and traffic patterns are continuously analyzed to refine evaluation criteria and thresholds. This feedback loop enables the system to maintain high detection precision through learned insights while operating at automated speeds, eliminating the need for manual analysis in routine scenarios
Data Source
AI summary
A system and method for detecting a Denial of Service (DoS) attack. A number of evaluator elements (M) is determined for DoS analysis for network connection requests wherein each evaluator element is preferably associated with a component of the analyzed connection request. A DoS evaluator element score is determined for an evaluator element of the connection request by analyzing the evaluator element. DoS mitigation actions may be performed on the connection request if the determined evaluator element score is indicative of a DoS attack. An evaluator consolidated score (which may be weighted) is then calculated preferably consisting of one or more of the respective DoS evaluator element scores. Next, a determination is made as to whether each evaluator element of the M evaluator elements has been analyzed for determining a respective DoS evaluator element score. If no, a DoS evaluator element score for a succeeding evaluator element to be analyzed is then determined. And if yes, a determination is then made as to whether the value of the evaluator consolidated score is indicative of a DoS attack by the subject analyzed network connection request.