Network Traffic Prioritization via Classification Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic mitigation techniques, such as Deep Packet Inspection (DPI) and rate limiting, often inadvertently drop legitimate traffic during Denial of Service (DoS) attacks, due to the difficulty in defining thresholds that distinguish between malicious and legitimate traffic flows.
Innovation Solution
A method and system that prioritize network traffic by intercepting and analyzing data packets, assigning classification types based on prescribed criteria, and using a token bucket algorithm with multiple limit thresholds to determine if packets should be dropped, queued, or marked, ensuring that only packets within configured bandwidth limits are forwarded to the protected network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rate limiting is used to ensure protected service will not experience excessive traffic, then network stability is improved, but legitimate network traffic flow is likely to be dropped
Solution Approach 1:
The system performs preliminary classification and scoring of network packets before applying rate limiting. By analyzing packet characteristics and assigning classification types with associated bandwidth thresholds in advance, the system can distinguish legitimate traffic from malicious traffic beforehand, allowing rate limiting to be applied selectively rather than uniformly to all traffic
Solution Approach 2:
The patent applies different bandwidth threshold values to different classification types of packets. Instead of using a single uniform rate limit, the system assigns specific threshold values to different packet classifications, allowing legitimate traffic to be treated differently from malicious traffic based on their respective classifications and thresholds
2Reliability
If Deep Packet Inspection is used to determine whether to drop or pass packets, then network security is improved, but there is a gray area where legitimate traffic may be dropped due to difficulty in defining thresholds
Solution Approach 1:
The system changes the parameter of bandwidth threshold assignment by associating different threshold values with different classification types. Instead of using a single threshold or arbitrary thresholds, the patent establishes a structured system where each classification type has a prescribed bandwidth threshold, making the decision process more objective and reducing the gray area where legitimate traffic might be incorrectly dropped
Data Source
AI summary
A computer method and system for prioritizing network traffic flow to a protected computer network. Network traffic flowing from one or more external hosts to the protected computer network is intercepted and intercepted data packets are dropped if forwarding the intercepted data packet to the protected network would cause the value of the bandwidth of network traffic flow to the protected network to exceed a configured overall traffic bandwidth threshold value associated with the protected network. If not dropped, the intercepted data packet is analyzed to determine a classification type for the intercepted data packet based upon prescribed criteria wherein each classification type has an assigned classification bandwidth threshold value, wherein the classification bandwidth threshold value is less than the overall traffic bandwidth threshold value for the protected network. The intercepted data packet is dropped if forwarding the intercepted data packet would cause the value of the bandwidth of traffic flow to the protected network to exceed the bandwidth threshold value assigned to the determined classification type of the intercepted packets.