Session Processing Device for Real-Time Malicious Attack Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for determining malicious attacks on servers are hindsight-based and prone to misjudgment due to Network Address Translation (NAT) conversions, leading to resource consumption and operational impact before attacks are identified.
Innovation Solution
A method and device that capture packets from clients, reconstitute packet flows based on quintets, extract behavior attributes, and interrupt sessions if these attributes exceed pre-configured baselines, preventing malicious attacks by identifying abnormal behavior in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If determination of malicious attack is based on statistics of received packets using source addresses, then the server can identify malicious attacks, but the determination is posterior to the attack and the server's capability to accept new connections is already adversely impacted
Solution Approach 1:
The patent reconstitutes packet flows and extracts behavior attributes in advance before the attack fully manifests. By analyzing packet flow patterns, connection frequencies, and behavior attributes proactively, the system identifies malicious sessions before they cause significant resource consumption, enabling preemptive blocking rather than reactive response.
Solution Approach 2:
The patent introduces packet flow reconstitution and behavior attribute extraction as intermediary processes between raw packet capture and attack determination. These intermediary steps transform raw packet data into meaningful behavior patterns, enabling more accurate and timely malicious session identification without directly relying on simple source address statistics.
2Adaptability or versatility
If source addresses are converted into a same address via NAT or gateway, then multiple clients can access the server, but the server is prone to misjudge the accesses from these clients as malicious attack
Solution Approach 1:
The patent transitions from analyzing single-dimension source address statistics to multi-dimensional packet flow analysis. By reconstituting packet flows using quintets (source address, destination address, source port, destination port, protocol number) and extracting behavior attributes, the system adds temporal and behavioral dimensions to distinguish legitimate NATted clients from actual attackers.
Solution Approach 2:
The patent applies different analysis methods to different packet characteristics. Instead of uniformly treating all packets from a source address equally, it analyzes specific packet flow patterns, connection frequencies, and behavior attributes locally to determine malicious intent, allowing legitimate NATted clients to be distinguished from attackers despite address conversion.
Data Source
AI summary
A method for processing session and a device thereof, a server and a storage medium are provided. The method includes: capturing packets sent from a client associated with the session; reconstituting a packet flow of the session from the captured packets based on quintets of the packets, wherein the quintet comprises a source address, a destination address, a source port, a destination port and a protocol number of the packet; extracting a behavior attribute of the client from the packet flow; determining that the behavior attribute of the client is beyond a baseline; and interrupting the session with the client.