Network Switch Packet Classification for DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network systems face challenges in detecting and preventing denial-of-service attacks and loops, which can lead to resource depletion and service disruption, especially due to high volumes of TCP connection setup requests and ICMP packets, making it difficult to differentiate between legitimate and illegitimate traffic.
Innovation Solution
A method and system for intrusion detection and prevention based on packet type recognition, where network packets are classified and rate-limited based on their type, with thresholds set to regulate traffic flow, using a packet classifier, signature engine, and rate limiter to identify and mitigate potential attacks by dropping excessive packets of specific types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network switches forward all received packets without filtering, then network throughput is maximized, but the system becomes vulnerable to denial-of-service attacks and traffic loops that can render the switch inoperable
Solution Approach 1:
The patent implements preliminary action by proactively detecting potential DoS attacks and traffic loops before they can overwhelm the switch. The system continuously monitors packet rates and patterns, identifying suspicious traffic early in its progression. This allows the switch to take preventive measures such as rate-limiting or blocking malicious traffic before it reaches critical thresholds that would render the switch inoperable, thus maintaining both high throughput and reliability.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a packet filtering and rate-limiting system positioned between incoming traffic and the switch's forwarding plane. This intermediary layer inspects packets, identifies malicious patterns, and selectively blocks or rate-limits suspicious traffic while allowing legitimate packets to pass through. This mediator protects the switch's operability without significantly impacting the throughput of legitimate network traffic.
2Reliability
If the switch implements comprehensive packet inspection and filtering, then protection against attacks is improved, but processing overhead and latency increase
Solution Approach 1:
The patent applies segmentation by dividing the packet inspection process into multiple stages: a fast path for clearly legitimate traffic that requires minimal processing, and a slow path for suspicious packets that require deeper inspection. The system segments traffic based on simple criteria (such as packet rate thresholds) and applies different levels of scrutiny accordingly. This segmented approach protects against attacks while minimizing the processing time overhead for legitimate traffic.
Solution Approach 2:
The patent utilizes parameter changes by dynamically adjusting inspection depth and filtering criteria based on observed traffic patterns. When traffic appears normal, the system uses lighter-weight filtering with lower processing overhead. When suspicious patterns emerge, the system intensifies inspection for affected traffic flows while maintaining standard processing for other traffic. This adaptive parameter adjustment provides strong attack protection without imposing constant high processing overhead on all packets.
3Reliability
If rate limiting is applied to all packet types, then denial-of-service attacks are prevented, but legitimate high-volume traffic is also restricted
Solution Approach 1:
The patent implements local quality by applying rate limiting selectively to specific packet types, sources, or destinations rather than uniformly to all traffic. The system identifies characteristics of malicious traffic (such as abnormal packet rates, unusual protocols, or suspicious source addresses) and applies rate-limiting measures only to traffic exhibiting those characteristics. Legitimate high-volume traffic that lacks malicious indicators continues to flow at full rate, thus maintaining productivity while providing attack mitigation through localized rate limiting.
Data Source
AI summary
Certain aspects of a method and system for intrusion detection and prevention based on packet type recognition in a network are disclosed. Aspects of one method may include determining a packet type for each of a plurality of received network packets based on at least one of: a header and content of each of the plurality of received network packets. The rate at which the plurality of received network packets are handled at a port in the network switching device may be regulated based on a number of occurrences of the determined packet type of the plurality of received network packets.