Selective Rate Limiting via Hybrid Local Remote Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Volumetric attacks, such as DDOS, are difficult to detect when distributed across multiple nodes and locations, as the request rate at each node may be insufficient to trigger attack protections, and traditional methods often interfere with valid traffic, incorrectly blocking legitimate clients.
Innovation Solution
Selective rate limiting system that uses customized rules to differentiate attack traffic from valid traffic by inspecting various traffic dimensions, applying specific signals, and implementing tailored protections based on unique client identifiers and traffic patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional attack protections based on request rates are used, then attack traffic can be detected, but valid clients with high request rates are incorrectly blocked
Solution Approach 1:
The patent segments the request rate evaluation into multiple dimensions: per-client rate limiting and per-IP address rate limiting. By dividing the monitoring scope, the system can apply different thresholds and rules to different segments, allowing valid clients with high request rates to be distinguished from attackers based on their IP address-specific patterns.
Solution Approach 2:
The patent applies different rate limiting characteristics to different IP addresses locally. Each IP address has its own configurable threshold and rate limit parameters, allowing the system to adapt to local traffic patterns and behaviors rather than applying a uniform global threshold that blocks valid high-volume clients.
2Object-affected harmful factors
If request rate thresholds are increased to accommodate valid clients, then false positives are reduced, but attack traffic may go undetected
Solution Approach 1:
The system segments rate limiting into two independent mechanisms: per-client rate limiting with higher thresholds and per-IP address rate limiting with lower thresholds. This segmentation allows the system to maintain high sensitivity to attacks at the IP level while accommodating valid clients at the client level, resolving the trade-off between sensitivity and false positives.
Solution Approach 2:
The patent applies partial rate limiting actions based on the type of traffic. For suspected attack traffic from single IP addresses, strict rate limiting is applied. For legitimate client traffic, more lenient rate limiting is applied. This partial action approach ensures attacks are detected without unnecessarily blocking valid clients.
3Ease of operation
If distributed attack traffic is monitored at each node separately, then node-level control is maintained, but distributed attacks are missed
Solution Approach 1:
The patent implements a universal rate limiting mechanism that operates at multiple levels simultaneously. The per-IP address rate limiting component provides node-level control while also detecting distributed attacks by tracking requests from the same IP address across different nodes. This multi-functional approach maintains ease of operation while improving distributed attack detection.
4Adaptability or versatility
If bot traffic is obfuscated to mirror valid traffic patterns, then attack detection becomes difficult, but traffic inspection complexity increases
Solution Approach 1:
The system segments traffic inspection into distinct analysis layers: client-level behavior analysis and IP address-level pattern analysis. By segmenting the inspection process, the system can identify bot traffic through multiple independent indicators rather than relying on a single complex signature, reducing overall inspection complexity while maintaining adaptability to obfuscated traffic.
Data Source
AI summary
Systems and methods perform selective rate limiting with a distributed set of agents and a remote controller. An agent receives a packet from a client, and inspects the packet using different rules. Each rule may include at least one different (i) rule definition with traffic dimensions identifying a different attack, (ii) signal with which to identify attack traffic matching the rule definition, (iii) threshold specifying a condition, and (iv) action to implement based on the condition of the threshold being satisfied. The agent provides the signal in response to the packet matching the traffic dimensions from the rule definition of a particular rule. The controller updates a value linked to the signal and a client identifier of the client, and implements the action of the particular rule across the distributed set of agents in response to the value satisfying the condition for the particular rule threshold.