TCP SYN-ACK Flood Detection with Bloom Filter State Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DDOS attacks using TCP SYN-ACK packets consume network resources by transmitting multiple SYN-ACK packets that do not correspond to any SYN packets, posing challenges in detection due to the collection of large amounts of state information.
Innovation Solution
Implementing a probabilistic data structure, such as a bloom filter, to store information associated with TCP SYN packets, using hash functions to reduce data size, and maintaining current and previous bloom filters to keep the data up-to-date, allowing only SYN-ACK packets that match previously sent SYN packets to be forwarded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If TCP SYN-ACK packets are monitored and state information is collected to detect flooding attacks, then detection accuracy is improved, but memory consumption increases substantially
Solution Approach 1:
The patent extracts only the essential identifying information from TCP SYN packets (source IP, destination IP, source port, destination port) and stores it in a probabilistic data structure (bloom filter), rather than monitoring and storing complete packet state information. This extraction approach maintains detection accuracy while substantially reducing memory consumption.
Solution Approach 2:
The patent changes the parameter representation by using hash functions to transform the 4-tuple information into compact hash values stored in the bloom filter. This parameter transformation reduces the storage requirements from full packet state information to condensed hash representations, resolving the memory consumption issue while preserving detection capability.
2Reliability
If complete TCP state information is monitored to accurately identify legitimate SYN-ACK packets, then detection reliability is improved, but device complexity increases
Solution Approach 1:
The patent introduces a probabilistic data structure (bloom filter) as an intermediary between packet monitoring and detection decision-making. This intermediary structure simplifies the system by providing efficient membership testing capabilities, reducing the complexity of tracking TCP state information while maintaining reliable detection of legitimate SYN-ACK packets.
Solution Approach 2:
The patent creates a simplified copy of the essential TCP SYN packet information in the form of hash values stored in the bloom filter, rather than maintaining complete state information. This copying approach reduces system complexity by working with condensed representations that are sufficient for detection purposes.
Data Source
AI summary
A network monitoring device can include one or more memory devices that can store executable instructions thereon that, when executed by one or more processors, cause the one or more processors to monitor network traffic transmitted across a communications network, detect at least one first data packet corresponding to a request to establish a communication session, ingest first information associated with the at least one first data packet into a probabilistic data structure, identify at least one second data packet corresponding to a response, determine that the response does not correspond to either (i) the request or (ii) a plurality of requests, and drop the at least one second data packet from the communications network.