Request Routing Mechanism Attack Detection via Mapping Consistency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed computing systems face challenges in effectively identifying and mitigating large-scale attack traffic, such as botnet and DDOS attacks, which can overwhelm their defenses and disrupt service.
Innovation Solution
Implementing a request routing mechanism that communicates its state to service endpoints and intermediate equipment, allowing for mapping consistency checks to identify and block suspicious traffic by ensuring clients adhere to the routing directions, and using a threat detection component to initiate mapping changes during attacks to redirect traffic and mitigate threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional request routing mechanisms are used to route client requests to service endpoints, then service availability and load balancing are improved, but the system becomes vulnerable to large-scale attacks such as botnet and DDOS attacks that can overwhelm defenses
Solution Approach 1:
The system implements feedback by having service endpoints report back to the request routing mechanism about whether they received requests from particular client IP addresses. This feedback loop enables the routing mechanism to learn which client-destination mappings are being exploited by attackers, allowing it to dynamically adjust routing decisions and redirect attack traffic away from vulnerable endpoints while maintaining normal service routing.
Solution Approach 2:
The request routing mechanism acts as an intermediary between clients and service endpoints. It intercepts and examines routing requests, makes intelligent decisions about which endpoint should receive each client's requests based on current system state and attack patterns, and forwards requests accordingly. This intermediary position allows it to protect endpoints from attack traffic while maintaining legitimate service operations.
2Measurement precision
If the system monitors and checks mapping consistency for every client request to detect attacks, then attack detection accuracy is improved, but system complexity and processing overhead increase
Solution Approach 1:
The system applies partial monitoring by focusing attack detection efforts on specific indicators rather than analyzing every aspect of each request. It primarily checks whether client IP addresses appear in feedback reports from service endpoints, which is a targeted subset of possible attack indicators. This selective approach maintains high detection accuracy for botnet attacks while avoiding the complexity of comprehensive request analysis.
Solution Approach 2:
The system performs preliminary action by pre-establishing feedback collection mechanisms at service endpoints before attacks occur. Endpoints are configured to report client IP addresses proactively, creating a baseline of normal traffic patterns. When potential attacks are detected, the system can quickly compare against this pre-established information without needing to analyze every request in real-time, reducing processing complexity.
3Reliability
If the request routing mechanism dynamically changes routing mappings to mitigate attacks, then attack mitigation effectiveness is improved, but service performance and client experience may deteriorate
Solution Approach 1:
The system applies local quality by making routing changes only for specific client IP addresses that are identified as attack sources, rather than applying blanket routing changes to all clients. Legitimate clients continue to receive optimal routing to nearest or least-loaded endpoints, maintaining high service performance. Only the local subset of attack traffic is redirected to mitigation destinations, preserving overall service quality.
Solution Approach 2:
The routing mappings are made dynamic rather than static, allowing the system to adapt routing decisions in real-time based on detected attack patterns. When attacks are identified, the routing mechanism dynamically updates mappings to redirect suspicious traffic while continuously monitoring to detect when normal operations resume. This dynamic approach ensures mitigation effectiveness while minimizing performance impact through automatic adaptation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Among other things, this document describes systems, methods and apparatus for identifying and mitigating network attacks, particularly botnet attacks and other volumetric attacks. In some embodiments, a distributed computing platform provides client-facing service endpoints and a request routing mechanism (request router or RR) directing clients to a particular service endpoint or cluster thereof to obtain a service. The state of the RR at a given time is communicated to enforcement points in the system, which may be cluster equipment, service endpoints, or other components. When client traffic arrives at a particular enforcement point it is checked for consistency with the RR's directions, referred to as 'mapping consistency'. This information is incorporated into decisions about how to handle the packets from the client.