Packet Sequence Number Detection for Denial of Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack an efficient method to detect and prevent denial of service attacks, which disrupt server operations by overwhelming data buffers with malicious network traffic, exploiting weaknesses in communication protocols.
Innovation Solution
A method and system that compare sequence numbers and acknowledgment numbers of incoming packets with previously recorded values to identify and block malicious packets, utilizing a firewall to prevent them from reaching targeted devices, thereby protecting computer systems from denial of service attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If servers increase data buffer capacity to handle more network traffic, then the server can accommodate higher traffic volumes, but the server becomes more vulnerable to buffer overflow attacks and consumes more resources
Solution Approach 1:
The system performs preliminary detection of malicious packets by comparing sequence numbers and acknowledgment numbers against recorded values before the packets reach the server's data buffer. This preliminary action identifies and blocks attack traffic in advance, preventing buffer overflow conditions without requiring increased buffer capacity
Solution Approach 2:
The patent introduces a detection system that acts as an intermediary between the network and the server. This intermediary monitors packet characteristics (sequence numbers, acknowledgment numbers) and filters out malicious traffic before it can overwhelm the server's data buffer, thereby protecting the server without requiring the buffer to be larger
2Reliability
If servers implement traditional intrusion detection methods, then some malicious attacks can be identified, but the detection is insufficient against sophisticated denial of service attacks that exploit protocol weaknesses
Solution Approach 1:
The patent changes the detection parameters from traditional intrusion detection methods to specific TCP protocol parameters (sequence numbers and acknowledgment numbers). By monitoring these specific parameters for duplication patterns, the system achieves sophisticated attack detection without requiring complex detection algorithms or multiple detection layers
3Productivity
If servers process all incoming network traffic to ensure legitimate requests are handled, then service availability is maintained, but malicious packets consume valuable server resources and slow down legitimate traffic processing
Solution Approach 1:
The system extracts and removes malicious packets from the network traffic stream before they reach the server. By comparing sequence numbers and acknowledgment numbers against recorded values, the detection system identifies and blocks duplicate packets that indicate denial of service attacks, allowing only legitimate traffic to proceed to the server for processing
Solution Approach 2:
The detection and filtering of malicious packets occurs in advance before the packets reach the server's processing queue. This preliminary action prevents malicious traffic from consuming server resources, ensuring that legitimate traffic is processed without delay or resource degradation
Data Source
AI summary
A method for detecting malicious packets includes comparing a sequence number of an input packet with sequence numbers of one or more previously input packets and detecting a malicious packet when the sequence number of the input packet matches at least one of the sequence numbers of the previously input packets.