SDN Nodes Detect Link Flooding DDoS Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current countermeasures are ineffective against link flooding DDoS attacks, as they cannot detect or mitigate the saturation of network links caused by illegitimate sources, which isolates victims from the network without identifying the attacker.
Innovation Solution
A method implemented in a Software-Defined Networking (SDN) architecture, where nodes and a controller detect congested links by analyzing flow rates and source behavior, identifying suspicious sources, and rerouting legitimate traffic to avoid congested links, thereby mitigating the attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If link flooding DDoS attack is launched, then network link saturation occurs isolating the victim, but the attacker cannot be identified
Solution Approach 1:
The patent introduces network nodes as intermediaries between the attacker and the victim. These nodes monitor traffic flows and detect congestion patterns, acting as mediators that can identify the attacker's presence and behavior without being the direct target of the attack. The intermediary nodes collect information about source IPs and traffic characteristics to enable attacker identification while protecting the victim's network infrastructure.
2Measurement precision
If conventional countermeasures are applied, then server flood detection is improved, but link flooding attacks remain undetectable
Solution Approach 1:
The patent creates a universal detection mechanism that can handle multiple types of DDoS attacks through a single system. The congestion detection module is designed to identify both server flood patterns and link flooding patterns by monitoring network traffic characteristics and congestion indicators. This multi-functional approach allows the system to adapt to different attack types without requiring separate detection mechanisms for each attack variant.
Solution Approach 2:
The patent employs parameter changes by monitoring multiple traffic parameters simultaneously, including flow rates, source IP distributions, and congestion indicators. By tracking changes in these parameters over time, the system can detect the distinctive patterns of link flooding attacks, where multiple sources generate traffic that collectively saturates network links. The detection thresholds and parameters are dynamically adjusted to accommodate different attack scenarios.
3Difficulty of detecting and measuring
If traffic monitoring is implemented to detect link saturation, then attack detection capability is improved, but system complexity increases
Solution Approach 1:
The patent divides the detection system into multiple independent network nodes, each responsible for monitoring traffic on specific network segments or links. This segmentation allows the overall detection task to be distributed across multiple simpler components rather than requiring a single complex centralized system. Each node independently collects traffic data and detects congestion on its local segment, then shares information with other nodes to achieve comprehensive network-wide detection.
Solution Approach 2:
The patent implements self-service by enabling network nodes to autonomously detect congestion and identify potential attackers without requiring external intervention or complex centralized coordination. Each node independently monitors its own traffic flows, applies detection algorithms, and generates alerts when link flooding is detected. This self-service approach reduces system complexity by eliminating the need for complex inter-node communication protocols and centralized control mechanisms.
Data Source
Figure 1~2B
Figure 3
Figure 4A
AI summary
This method of detecting illegitimate sources responsible for a DDoS attack by flooding a link in a network consists of: updating (110), by one of the two nodes connected by said link (Li-j), a local list of sources (Fi-j) listing the sources whose flows are circulating on said link at the given time; checking (120) whether said link is congested; and, when said link is congested, implementing (140) at least one detection rule on each source indicated in said local list, said detection rule allowing to track a behavior of said source; and, if said source verifies said detection rule, assigning said source a status "suspect", otherwise assigning said source a status "safe"; and updating, by the controller (11), a consolidated list of sources (LS) containing at least the sources whose status at the current time is "suspect".