Packet Discard Monitoring for Denial of Service Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional intrusion detection systems face challenges in detecting and preventing flooding attacks, as they struggle to distinguish between legitimate and illegitimate traffic, leading to false detections and high overhead, and often fail to determine the source of the attack due to spoofed IP addresses.
Innovation Solution
Monitoring the number and rate of packet discards, raising an event when a specified percentage of traffic is discarded, and tracing the source of a flood back to a prior hop, with policies specifying minimum discard thresholds to trigger further detection and monitoring, thereby reducing processing overhead and identifying potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If traditional intrusion detection systems monitor inbound traffic to detect flooding attacks, then attack detection capability is improved, but processing overhead increases and false detections occur
Solution Approach 1:
The patent extracts the attack detection function from the main packet processing path by monitoring packet discard counters in the network stack. Instead of processing every incoming packet for attack detection, the system monitors the network stack's own discard decisions, which indirectly indicate flooding attacks without requiring continuous mainline processing.
Solution Approach 2:
The patent uses packet discard events as an intermediary indicator to detect flooding attacks. Rather than directly analyzing packet contents or source addresses in the main processing path, the system monitors the network stack's discard decisions, which serve as a mediator that translates complex packet analysis into simpler counter-based detection.
2Measurement precision
If traditional systems attempt to distinguish between legitimate and illegitimate traffic, then detection accuracy is improved, but complexity increases and false detections occur
Solution Approach 1:
The patent inverts the traditional detection approach by not attempting to distinguish legitimate from illegitimate traffic directly. Instead, it monitors the network stack's own actions (packet discards) that occur when traffic is flooded, using the stack's discard decisions as the detection signal rather than analyzing packet characteristics.
Solution Approach 2:
The patent leverages the network stack's built-in packet validation and discard mechanisms to perform attack detection. The network stack's own packet checking and discard functions are used as the detection mechanism, eliminating the need for separate complex detection algorithms.
3Measurement precision
If packet discard monitoring is performed on every discarded packet, then detection sensitivity is improved, but processing time increases
Solution Approach 1:
The patent implements periodic monitoring of packet discard counters rather than continuous processing of every discarded packet. The system monitors discard counts at specific intervals or when threshold conditions are met, reducing processing frequency while maintaining effective attack detection capability.
Data Source
AI summary
The invention detects a denial of service attack at a node by monitoring the number of discarded packets in relationship to the number of inbound packets. When an attack is detected, relevant inbound packet information is collected during the attack to help characterize the attack and at least to pinpoint the source of the last hop to the attacked node.