Cyber-Attack Scanner Detection via Source and Destination IP Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DDoS detection tools are ineffective in early detection of cyber-attack scanners due to their design focus on high-volume traffic, allowing these scanners to go undetected, which can lead to significant impact from subsequent DDoS attacks.
Innovation Solution
A system using a Modified Bloom Filter with floating-point counters and a circular buffer to identify suspicious source IP addresses, followed by determining the diversity of destination IP addresses, triggers an alarm to detect cyber-attack scanners before they initiate a DDoS attack, thereby minimizing the attack's scope.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional DDoS detection tools are used, then high-volume traffic can be detected, but cyber-attack scanners sending low-volume traffic in short bursts cannot be detected early
Solution Approach 1:
The patent changes the detection parameter from traffic volume threshold to source address frequency of occurrence. Instead of detecting based on high-volume traffic patterns, the system tracks how frequently each source address appears in the traffic stream, enabling detection of low-volume scanner traffic while maintaining ability to detect high-volume DDoS traffic.
Solution Approach 2:
The patent introduces a new dimension of analysis by examining destination address diversity for each source address. Rather than solely analyzing traffic volume or single-dimensional patterns, the system evaluates the variety of destination addresses contacted by each source, creating a multi-dimensional detection approach that captures scanner behavior across different traffic volumes.
2Reliability
If early detection of cyber-attack scanners is implemented, then the impact of DDoS attacks can be minimized, but additional computing resources are consumed for analysis
Solution Approach 1:
The patent performs preliminary detection and identification of cyber-attack scanners before they can initiate full-scale DDoS attacks. By detecting scanners early in their operation and blocking them proactively, the system prevents the much larger resource consumption that would occur during an actual attack, making the preliminary computational investment worthwhile.
Solution Approach 2:
The patent extracts and isolates the scanning behavior pattern from general traffic by identifying sources that contact multiple destination addresses in a characteristic scanner manner. Once identified, these scanner sources are separated from the normal traffic flow and blocked, allowing the main detection system to focus resources on analyzing remaining legitimate traffic.
3Measurement precision
If source addresses are tracked frequently to identify scanners, then early detection is achieved, but false positives from legitimate users may occur
Solution Approach 1:
The patent applies partial action by not blocking all addresses that contact multiple destinations, but rather blocking only those that exhibit the specific pattern of contacting many destinations with relatively low traffic volume per destination. This partial application of the detection criterion reduces false positives while maintaining scanner detection capability.
Solution Approach 2:
The system incorporates feedback mechanisms where detection results and blocked addresses are used to refine future detection. By learning from identified scanners and adjusting detection parameters based on observed patterns, the system improves its ability to distinguish scanners from legitimate users, reducing false positives over time.
Data Source
AI summary
A method and system for detecting and mitigation a cyber-attack scanner are provided. The method includes determining if a source network address designated in a received packet is suspicious as of a cyber-attack scanner, wherein the determination is based on a likelihood that the source address was previously frequently encountered; upon determining that the source network address is suspicious, determining diversity of destination network addresses sent by a source having the suspicious network address; and upon determining that the destination network addresses are diversified, generating an alarm indicating that a source network address is a cyber-attack scanner, wherein a cyber-attack scanner is a device to identify destination network addresses in a protected entity that be exploit for at least a cyber-attack scanner.