Network Traffic Redirection for Hidden DDoS Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for protecting communication networks against malicious data traffic, such as DDOS attacks, become unreliable when network environments change due to new applications, disabled applications, or structural changes, leading to ineffective detection and filtering of malicious data.
Innovation Solution
A method and apparatus that utilize a defender device to monitor data traffic, generate control signals to redirect malicious data traffic to itself by modifying network device tables, and terminate the malicious traffic using hidden MAC addresses, ensuring the device remains undetectable in the communication path.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traffic analysis is performed to detect malicious data traffic, then security reliability is improved, but processing time increases
Solution Approach 1:
The system performs preliminary classification of data traffic into normal and suspicious categories using machine learning models before detailed analysis. This preliminary action filters out obviously normal traffic early, allowing only potentially malicious traffic to undergo more time-consuming deep analysis, thus improving security reliability while minimizing overall processing time
Solution Approach 2:
The traffic analysis process is divided into multiple stages: initial filtering, machine learning-based classification, and detailed inspection of suspicious packets. This segmentation allows the system to apply different processing depths to different traffic types, ensuring high security for suspicious traffic while maintaining fast processing for normal traffic
2Measurement precision
If machine learning is used to classify data traffic, then detection precision is improved, but device complexity increases
Solution Approach 1:
The patent introduces a gateway server as an intermediary between the client and the server infrastructure. This gateway server hosts the machine learning models and performs classification locally, eliminating the need for complex ML infrastructure at every client device while maintaining high detection precision through centralized model management
Solution Approach 2:
The system uses pre-trained machine learning models that can be copied and deployed across multiple gateway servers. Instead of each device implementing complex ML algorithms, lightweight model copies are distributed to gateways, achieving high detection precision with minimal device complexity at the client端
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The present invention relates to a method for defending against a malicious data traffic, the method comprises: monitoring (310), by a defender device (230), data traffic flowing through a network device (120); generating (330) a first control signal, by the defender device (230), in response to a detection (320) that the data traffic comprises a predefined amount of malicious data traffic, to cause a delivery of the data traffic to the defender device (230); terminating (340) the malicious data traffic in the defender device (230). The invention also relates to an apparatus implementing the method, a computer program product and a system.