Tiered Blacklist Management for Network Attack Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional blacklist management systems for mitigating network attacks face inefficiencies due to resource consumption and limited ability to effectively manage different types of blacklists, leading to suboptimal mitigation of network threats.

Innovation Solution

A method involving a blacklist manager that monitors and manages multiple blacklists positioned at different tiers of a network protection system, allowing entries to be moved between blacklists based on monitoring results to optimize resource usage and threat mitigation efficiency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If deep packet inspection is used to mitigate network attacks, then threat detection capability is improved, but CPU and memory resource consumption increases

Engineering Contradiction:

Improvethreat detection capabilityVSAvoidCPU and memory resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system segments the packet inspection process into multiple tiers: a first tier performs initial packet inspection and classification, while a second tier performs more thorough inspection only for packets that pass the first tier. This segmentation reduces the overall resource consumption by avoiding exhaustive inspection of all packets, while maintaining effective threat detection through coordinated multi-tier inspection.

Inventive Principle:

Principle #1Segmentation

2Productivity

If a blacklist is used to block network traffic, then mitigation efficiency is improved, but the ability to adapt to new attack patterns deteriorates

Engineering Contradiction:

Improvemitigation efficiencyVSAvoidability to adapt to new attack patterns

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The system implements dynamic blacklist management where entries are automatically added, removed, or modified based on real-time monitoring of network traffic and attack patterns. The blacklist is updated dynamically through coordination between multiple tiers, allowing the system to adapt to new attack patterns while maintaining efficient blocking of known threats through established blacklist mechanisms.

Inventive Principle:

Principle #15Dynamics

3Reliability

If multiple blacklists are managed at different locations, then mitigation coverage is improved, but system complexity increases

Engineering Contradiction:

Improvemitigation coverageVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system merges the management of multiple blacklists into a unified coordinated approach where a first mitigation process and a second mitigation process work together. The blacklists are managed through a shared monitoring and update mechanism that coordinates between different locations (upstream and downstream), reducing operational complexity while maintaining comprehensive mitigation coverage through collaborative effort.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS10462166B2System and method for managing tiered blacklists for mitigating network attacks

Publication Date: 2019.10.29 ARBOR NETWORKS INC

AI summary

A method, system, and computer-implemented method to manage blacklists used for mitigating network traffic is provided. The method includes monitoring a first blacklist and a second blacklist, wherein the first blacklist is used by a first mitigation process applied to network traffic that is performed upstream along a communication path of the network traffic relative to a second mitigation process that is performed using the second blacklist. The method further includes moving at least one entry from one of the first and second blacklists to the other of the first and second blacklist based on a result of the monitoring.