Network Packet Detection Using Header Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques face challenges in detecting low-rate attacks, such as high costs, impact on normal communication quality, and limited detection capabilities, making it difficult to effectively identify and counter low-rate attacks like HTTP Flood and Slow Denial Of Service.
Innovation Solution
A detection device that calculates features from packet header information using unsupervised machine learning to classify packets as normal or abnormal, and employs supervised learning to identify attack tools, allowing for cost-effective detection and mitigation of low-rate attacks without affecting normal communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If packet sampling is performed for attack detection, then detection cost is reduced, but information about low-rate attacks cannot be acquired
Solution Approach 1:
The patent segments the packet analysis process into two parts: using only header information for feature calculation and classification, while excluding payload analysis. This segmentation enables continuous monitoring of all packets without the high cost of full packet inspection, thereby resolving the contradiction between detection cost and information acquisition.
2Measurement precision
If security device is connected in-line to detect attack communication, then detection accuracy is improved, but cost per Gbps increases
Solution Approach 1:
The patent extracts only the essential header information from packets for analysis, removing the need for expensive in-line security devices that require full packet inspection. By taking out only the necessary features (header fields) for attack detection, the system achieves adequate detection accuracy with significantly reduced device cost.
3Adaptability or versatility
If web server processes attack detection, then detection capability is improved, but QoS in normal communication is affected
Solution Approach 1:
The patent introduces a separate detection device that acts as an intermediary between the network and the web server. This mediator performs feature calculation and classification using only packet headers, enabling attack detection without burdening the web server, thus maintaining communication quality while improving detection capability.
4Measurement precision
If full packet inspection is performed, then attack detection accuracy is improved, but processing overhead on Web server increases
Solution Approach 1:
The patent extracts only the necessary header fields from packets for feature calculation, excluding the need to process the entire packet payload. This extraction approach maintains sufficient attack detection accuracy while dramatically reducing the processing overhead on the web server, as headers are much smaller and can be processed efficiently.
Data Source
AI summary
A feature calculation unit calculates a feature of header information of a packet. A classification unit classifies the packet as a normal packet or an abnormal packet by using the calculated feature. An adding unit adds a label indicating a tool name of a known attack tool to header information of a packet attacked using the attack tool. A learning unit learns the addition of the label by using the label and the feature calculated for the packet to which the label has been added as teacher data.