Parallel Packet Hashing for DoS Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic analysis techniques face challenges in efficiently detecting and mitigating denial of service (DoS) and distributed denial of service (DDoS) attacks due to high computational costs and high false positive or false negative rates, especially when processing large volumes of packets.
Innovation Solution
The method involves dividing packet sequences into modules for parallel processing, generating signatures to detect service floods and reflection floods, and using a hashing technique to reduce storage and processing delays, while sharing information across pipelines to minimize false rates and account for load imbalances.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If packet analysis is performed at high speed to detect attacks in real-time, then detection speed improves, but computational cost increases significantly
Solution Approach 1:
The patent divides the packet analysis system into multiple parallel processing pipelines, each handling a subset of packets. This segmentation allows the system to process packets in parallel, maintaining high detection speed while distributing computational load across multiple units, thereby reducing the computational burden on any single processing unit.
Solution Approach 2:
The patent applies hashing techniques that compute only essential features of packets rather than performing complete deep packet inspection. By calculating hash values of key packet fields (such as source IP, destination IP, protocol type) instead of analyzing entire packet contents, the system achieves sufficient detection capability with significantly reduced computational cost.
2Reliability
If aggressive packet filtering is applied to block attacker traffic, then attack mitigation improves, but false positive rate increases
Solution Approach 1:
The patent implements a feedback mechanism where the system continuously monitors packet patterns and adjusts filtering thresholds based on observed traffic characteristics. By analyzing the distribution of hash values and identifying anomalies that deviate from normal traffic patterns, the system dynamically adapts its filtering criteria to maintain high attack detection accuracy while minimizing false positives caused by legitimate traffic.
Solution Approach 2:
The patent changes the parameter of filtering aggressiveness by using statistical analysis of packet arrival rates and hash value distributions. Instead of applying fixed aggressive filtering rules, the system adjusts filtering parameters based on real-time traffic conditions, allowing it to be more lenient during normal conditions (reducing false positives) and more aggressive during detected attack conditions (improving detection accuracy).
3Object-generated harmful factors
If less aggressive packet analysis is used to reduce false positives, then false negative rate increases allowing attacker packets through
Solution Approach 1:
The patent merges the results from multiple independent hashing functions and processing pipelines to make final detection decisions. By combining evidence from different hash computations and cross-validating results across parallel pipelines, the system achieves high detection reliability without requiring any single analysis method to be overly aggressive, thereby maintaining low false negative rates while keeping individual analysis steps relatively gentle.
4Quantity of substance
If multiple hash functions are used to reduce storage requirements, then storage efficiency improves, but collision probability increases causing rate underestimation
Solution Approach 1:
The patent addresses collision issues by introducing temporal and spatial dimensions to the hashing process. Instead of relying solely on hash value uniqueness, the system considers the temporal distribution of packets with the same hash value and their spatial distribution across different pipelines. By analyzing patterns across multiple dimensions (time, space, hash value), the system can distinguish between legitimate traffic bursts and actual attacks even when hash collisions occur, maintaining measurement precision while using limited storage capacity.
Data Source
AI summary
In a system for detecting and optionally blocking packets from an attacker, an improved multi-hash process, in which rate information for one or more packet signatures is computed by individual modules, where each module corresponds to a different hash function, and is shared across the modules to determine maximum observed rates for the signatures within a specified observation window. A moving average of the maximum rates can be computed across several observation windows, to optimize false negative and false positive detections. The modules may designate certain packets as potentially harmful and/or may block such packets, according to a corresponding maximum rate and specified threshold.