Reflection DDoS Protection via Traffic Differentiation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods and systems are ineffective in detecting and blocking reflection Distributed Denial-of-Service (DDoS) attacks, as they fail to differentiate between legitimate and illegitimate traffic, often saturating network links and disrupting legitimate services.
Innovation Solution
A system comprising a detector device within the protected network and a guard device in the external network, where the detector monitors bidirectional traffic to identify unsolicited response packets and alerts the guard to filter or discard false responses, ensuring only legitimate traffic reaches the target node.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing DDoS protection methods monitor and filter traffic, then they can block some attack traffic, but they fail to differentiate between legitimate and illegitimate reflection traffic, causing network saturation and service disruption
Solution Approach 1:
The system performs preliminary actions by monitoring and recording outgoing request packets before the reflection attack traffic arrives. This allows the detector to establish a baseline of legitimate traffic patterns and create a reference database of expected responses, enabling it to identify and block illegitimate reflection traffic while allowing legitimate traffic to pass through without disruption
Solution Approach 2:
The system implements feedback mechanisms where the detector continuously monitors incoming traffic, compares it against recorded outgoing requests and established patterns, and dynamically adjusts filtering decisions. The guard device receives feedback from the detector about which packets to block, creating a closed-loop system that maintains service availability while blocking attacks
2Object-affected harmful factors
If the guard device blocks all incoming response packets to prevent reflection attacks, then attack traffic is stopped, but legitimate unsolicited responses are also blocked, denying legitimate access
Solution Approach 1:
The system applies different filtering qualities to different packets based on their characteristics. Rather than uniformly blocking all incoming responses, the detector analyzes each packet's properties (source IP, destination IP, packet type, timing patterns) and applies selective filtering - blocking packets that match attack patterns while allowing packets that match legitimate patterns to pass through
Solution Approach 2:
The system changes filtering parameters dynamically based on traffic analysis. The detector monitors parameters such as packet rate, source-destination IP relationships, and response timing patterns, adjusting the blocking threshold and filtering stringency according to the detected traffic characteristics, thereby adapting to both attack and legitimate traffic conditions
3Difficulty of detecting and measuring
If the detector monitors bidirectional traffic to identify unsolicited packets, then it can detect reflection attacks, but this increases system complexity and processing overhead
Solution Approach 1:
The system segments the traffic monitoring function into distinct components: the detector device that monitors and analyzes traffic patterns, the guard device that executes blocking actions, and the target node that generates and receives traffic. This segmentation allows each component to specialize in specific tasks, reducing overall system complexity while maintaining detection capability
Solution Approach 2:
The detector device serves as an intermediary between the monitoring function and the blocking function. It receives copies of outgoing request packets, monitors incoming traffic, analyzes patterns, and translates complex traffic analysis into simple blocking instructions for the guard device, thereby simplifying the overall system architecture
Data Source
AI summary
A method includes monitoring outgoing request packets transmitted by a node in a protected network over a link connecting the protected network to an external network. Incoming response packets that originate in the external network and are destined for transmission to the node are also monitored. One or more of the incoming response packets that were not solicited by any of the outgoing request packets are identified responsively to monitoring the outgoing request packets and the incoming response packets. A characteristic that differentiates between the identified incoming response packets and the incoming response packets that were solicited by the outgoing request packets is determined. A guard device in the external network is instructed to inhibit the transmission over the link of subsequent unsolicited response packets based on the characteristic.