Priority-Based Deep Packet Inspection for DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional deep packet inspection (DPI) systems face challenges in scaling to handle increasing traffic rates during DDoS attacks, as load-balancing techniques hinder information sharing between devices, leading to higher costs and complexity in building behavior histories.
Innovation Solution
A method that assigns a probability of threat indicator (PTI) to each source IP address, allowing for prioritized inspection checks based on the PTI, reducing the need for extensive inspection across all packets and enabling efficient information sharing between devices through a centralized PTI database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If load-balancing techniques are employed to distribute traffic across multiple devices, then the system can handle higher traffic rates, but information sharing between devices becomes harder and device complexity increases
Solution Approach 1:
The patent merges the behavior history functionality into a centralized cloud service that all network monitors access. Instead of each device maintaining separate behavior histories, they all query and contribute to a unified cloud-based history, eliminating the information silos created by load-balancing while avoiding the complexity of inter-device communication protocols.
Solution Approach 2:
The cloud service acts as an intermediary between network monitors and behavior history data. Rather than devices directly sharing information with each other (which would require complex peer-to-peer communication), the cloud mediates all information exchange, simplifying the architecture while enabling full information sharing across the distributed system.
2Measurement precision
If comprehensive inspection checks are performed on all packets, then detection accuracy improves, but computational cost increases
Solution Approach 1:
The patent applies different inspection intensities to different packets based on their characteristics. Packets from sources with established behavior histories receive lighter inspection, while packets from unknown or suspicious sources undergo comprehensive checks. This local differentiation of inspection quality optimizes both detection accuracy and computational resource utilization.
Solution Approach 2:
Instead of performing full inspection checks on every packet, the system performs partial checks on packets from trusted sources and reserves excessive (full) inspection capacity for suspicious packets. The cloud-based behavior history enables the system to confidently apply partial action to legitimate traffic while maintaining the capability for excessive action when needed for security.
Data Source
AI summary
A method of monitoring a network is provided. The method includes receiving a packet of network traffic, determining a source IP address of the packet, consulting a database of source IP addresses, each source IP address having an associated probability of threat indicator (PTI) that indicates a probability of threat posed by the source IP address. The packet's source IP address' PTI is assigned to the packet as the packet's PTI, and one or more inspection checks are selected to be performed on the packet, wherein the selection of the inspection checks is a function of the packet's source IP address PTI. The method further includes performing the selected inspection checks, assigning treatment of the packet based on a result of the inspection checks performed, and adjusting the packet's source IP address' PTI or the packet's PTI based on the result of the one or more inspection checks performed.