Request Isolation Routing for Malicious Traffic Containment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems struggle to manage and identify malicious requests effectively, as not all malicious requests are equal, and simply blocking all such requests can be an unsuitable response, leading to potential interference with normal request processing.
Innovation Solution
A request isolation system (RIS) that identifies malicious requests and routes them to a secondary computing system, maintaining normal request processing by using a quarantine system with reduced resources, thereby preventing interference and optimizing throughput.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all malicious requests are blocked, then system security is improved, but normal request processing is interfered with
Solution Approach 1:
The system segments request processing into two separate pathways: a primary processing system for normal requests and a secondary processing system for potentially malicious requests. This segmentation allows normal requests to be processed efficiently while isolating malicious traffic, thus maintaining both high throughput and system security.
Solution Approach 2:
A request routing component acts as an intermediary between the external request source and the processing systems. It receives requests, determines whether they are potentially malicious, and routes them to appropriate processing systems. This intermediary enables differentiated handling of requests without interfering with normal processing flow.
2Productivity
If a secondary processing system is used for malicious requests, then normal request processing is protected, but system complexity increases
Solution Approach 1:
The secondary processing system is designed as a simplified copy of the primary system, using the same processing logic but isolated for malicious requests. This copying approach protects normal processing while avoiding the need to design an entirely new complex system from scratch.
Solution Approach 2:
The system includes automated components that perform request analysis, routing decisions, and processing without human intervention. The self-service automation reduces operational complexity despite the dual-system architecture, as manual configuration and management are minimized.
Data Source
AI summary
System, method, and various embodiments for a request isolation system are described herein. An embodiment operates by determining a first request that has been processed by one or more computing services of a primary computing system. It is determined that processing resources used in processing the first request have exceeded a first computing threshold for the first request. It is determined that the first request is malicious based on the determination that the processing resources exceed the first computing threshold. A client of the primary computing system from which the malicious request was received is identified, a second request is received from the client, and the second request is routed to a secondary computing system for processing based on the determination that the first request was malicious.