Packet Rate Limiting for DoS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting and mitigating Denial of Service (DoS) attacks in IP networks are ineffective, particularly in distinguishing between legitimate and spoofed packets, and are not well-suited to handle attacks involving many small packets, leading to system overload and prolonged vulnerability windows.
Innovation Solution
Implementing a packet rate limiting system that configures a packet rate limit for an ACL interface, counting packets, and discarding excess packets to prevent system overload, using a packet rate limit counter and housekeeping processor to enforce rate limiting rules, allowing for fast and efficient detection and mitigation of DoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual filtering of attack traffic is implemented, then attack mitigation is achieved, but response time increases to minutes and system vulnerability window is prolonged
Solution Approach 1:
The system performs automatic packet filtering based on pre-configured rate limits without requiring manual intervention. The router autonomously monitors packet arrival rates and discards excess packets according to the defined policy, eliminating the need for manual filter installation and activation that causes minute-scale delays.
Solution Approach 2:
Rate limit parameters are configured in advance before attacks occur. When traffic exceeds the predetermined threshold, the system immediately activates the filtering action without waiting for detection and manual response, reducing the vulnerability window from minutes to near-instantaneous response.
2Productivity
If byte rate based rate limiting is used, then traffic control is achieved, but effectiveness against attacks with many small packets is reduced
Solution Approach 1:
The system changes the measurement parameter from byte rate to packet rate. By counting the number of packets arriving at the interface rather than measuring total data volume, the system effectively detects and limits attacks composed of many small packets that would be invisible to byte-rate-based mechanisms.
3Measurement precision
If complex state tracking and multiple timestamps are used for rate limiting, then measurement precision is improved, but implementation complexity increases
Solution Approach 1:
The system extracts and uses only the essential information needed for rate limiting - the packet arrival count at the interface. By removing unnecessary state tracking mechanisms and multiple timestamps, the implementation achieves sufficient precision with minimal complexity, using simple packet counters rather than complex measurement systems.
Data Source
AI summary
The packet rate limiting method and system is used for detecting and blocking the effects of DoS attacks on IP networks. The method uses an ACL counter that stores an action parameter in the first 3 most significant bits and uses 13 bits as a packet counter. A rate limit is enforced by setting the packet counter to an initial value, and resetting this value at given intervals of time. The action parameter enables the ACL to accept or deny packets based on this rate limit. If the number of packets in the incoming flow saturates the packet counter before the reset time, the packets are denied access to the network until the counter is next reset. The denied packets may be just discarded or may be extracted for further examination.