OS Fingerprint Packet Filtering for DDoS-Resistant Server Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DDoS attack detection methods are easily evaded by hackers, making target services susceptible to DDoS attacks, particularly due to the forgery of HTTP request packets.
Innovation Solution
A packet processing method that extracts fingerprint features from transport-layer and network-layer packet headers to identify the operating system type of terminal devices, using a fingerprint feature database to determine whether to allow or block access, thereby preventing DDoS attacks by recognizing valid user access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If HTTP request packet format detection is used to identify DDoS attacks, then attack detection capability is improved, but detection accuracy deteriorates because attack packets can be easily forged
Solution Approach 1:
The patent segments the packet analysis into multiple layers: network layer (IP header fields like TTL, TOS, source/destination addresses) and transport layer (TCP/UDP header fields like window size, MSS, timestamps). This multi-layer segmentation allows the system to examine different aspects of packet authenticity independently, making it harder for attackers to forge all layers simultaneously and improving overall detection accuracy while maintaining reliability
Solution Approach 2:
The patent transitions from single-dimension HTTP payload analysis to multi-dimensional analysis by incorporating network layer and transport layer characteristics. This dimensional expansion creates a more comprehensive detection space where attack packets must satisfy multiple constraints simultaneously, significantly reducing the ability to forge packets and improving measurement precision without sacrificing detection capability
2Measurement precision
If transport-layer and network-layer fingerprint features are extracted and analyzed, then packet processing accuracy is improved, but device complexity increases
Solution Approach 1:
The patent performs preliminary extraction of fingerprint features from packet headers before full packet processing. By pre-identifying key characteristics such as TTL values, TCP window sizes, and IP address patterns, the system prepares authentication data in advance, reducing the computational burden during the main processing stage and managing device complexity while maintaining high accuracy
Solution Approach 2:
The patent extracts only the essential fingerprint features from packet headers rather than analyzing entire packets. By selectively taking out critical fields like IP addresses, port numbers, and specific header characteristics, the system reduces processing complexity while preserving the authentication accuracy needed to distinguish legitimate from malicious traffic
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This application provides a packet processing method, including: receiving, by a protection device, a first access request packet, where the first access request packet includes a packet sent based on a TCP/IP protocol; extracting a first fingerprint feature from a transport-layer packet header and/or a network-layer packet header of the first access request packet, where the first fingerprint feature corresponds to an operating system type of a terminal device that sends the first access request packet; recognizing the first fingerprint feature based on a fingerprint feature database to determine whether to allow the first access request packet to access a server, where the fingerprint feature database includes a fingerprint feature corresponding to an operating system type of a terminal device that is allowed to access the server and/or a fingerprint feature corresponding to an operating system type of a terminal device that is not allowed to access the server; and if the first access request packet is allowed to access the server, allowing the first access request packet to pass through; or if the first access request packet is not allowed to access the server, blocking the first access request packet. This resolves a technical problem that hackers can evade attack detection with relative ease to make a server susceptible to DDoS attacks.