Router ID-Based DDoS Mitigation via Traffic Sampling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication networks face difficulties in identifying and mitigating distributed denial of service (DDoS) attacks, particularly with connectionless protocols like UDP, as malicious actors can spoof multiple IP addresses, making it challenging to distinguish legitimate traffic from malicious floods.
Innovation Solution
The method involves using router identifiers to differentiate between legitimate and malicious traffic by assigning unique router IDs to ingress routers within an autonomous system, with a threat intelligence system sampling packets to determine if the router IDs match expected distributions, and invoking mitigation actions when discrepancies are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IP address blocking is used to mitigate DDoS attacks, then single-source attacks can be blocked, but multi-source DDoS attacks cannot be effectively stopped
Solution Approach 1:
The patent segments the attack mitigation approach by moving from blocking individual IP addresses to blocking traffic based on router identifier mismatches. Instead of treating each attacking IP separately, the system segments the problem at the router level by inserting and verifying router IDs in packet headers, allowing effective mitigation against distributed multi-source attacks where traditional IP blocking fails.
2Reliability
If router identifier verification is implemented to distinguish legitimate from malicious traffic, then DDoS attack mitigation improves, but network traffic processing complexity increases
Solution Approach 1:
The patent applies preliminary action by having ingress routers insert their router identifiers into packet headers before traffic enters the autonomous system. This pre-insertion of authentication data occurs at the network edge, allowing downstream routers to perform simple verification without complex analysis, thereby reducing overall processing complexity while maintaining high authentication accuracy.
Solution Approach 2:
The router identifier acts as an intermediary authentication mechanism between the ingress router and egress routers. Instead of requiring complex direct verification between endpoints, the router ID serves as a mediating credential that simplifies the authentication process across multiple routing hops, reducing processing complexity while ensuring traffic legitimacy.
3Measurement precision
If comprehensive traffic monitoring and analysis are performed to detect DDoS attacks, then attack detection accuracy improves, but network overhead and processing time increase
Solution Approach 1:
The patent extracts the authentication verification from complex traffic analysis by focusing specifically on router identifier matching. Instead of monitoring and analyzing all traffic characteristics to detect attacks, the system extracts and verifies only the router ID field, dramatically reducing processing time while maintaining high attack detection accuracy through this targeted verification approach.
Data Source
AI summary
Examples of the present disclosure are directed to systems and methods for using router identifier information to mitigate denial of service attacks in an autonomous system (AS). Each router of the AS may be assigned a router identifier (ID) that is unique to the AS and may be periodically changed. The ingress router first receiving the packet within a particular AS may insert its router ID into the packet. A threat intelligence system may sample packets of traffic received by the AS and examine the inserted ingress router IDs in making a threat determination. If a distribution of detected ingress router IDs from sampled packets does not match an expected distribution of ingress router IDs, one or more threat mitigation actions may be invoked.