Traffic-Shaping HTTP Proxy for DoS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for preventing Denial of Service (DoS) attacks, such as Distributed Denial of Service (DDoS), are ineffective in distinguishing between legitimate and malicious requests, leading to false identifications and increased downtime, and existing solutions like IP blocking and rate limiting can inadvertently harm legitimate users or fail to protect against high-entropy requests.
Innovation Solution
A proxy server that tracks a family of metrics, including cumulative backend utilization time and queue time, to prioritize requests and penalize clients with a history of heavy usage, thereby scheduling requests to mitigate attack effectiveness and reduce backend overload.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP blocking and rate limiting are used to prevent DoS attacks, then attack effectiveness is reduced, but legitimate users are inadvertently harmed and false identifications increase
Solution Approach 1:
The patent applies local quality by implementing per-client scheduling policies based on individual backend utilization metrics. Instead of uniform rate limiting, each client receives customized scheduling treatment according to their historical backend usage patterns, allowing legitimate high-volume clients to be distinguished from attackers through localized metric analysis
Solution Approach 2:
The system implements feedback by continuously monitoring backend utilization time and queue time metrics, then using this feedback to dynamically adjust request scheduling decisions. The scheduler observes backend performance and adapts its pacing decisions in real-time, creating a closed-loop control system that prevents both attack traffic and protects legitimate users
2Reliability
If traditional rate limiting is applied, then backend overload is reduced, but high-entropy requests from attackers are not effectively blocked
Solution Approach 1:
The patent changes parameters by transitioning from traditional rate limiting (request count per time window) to utilization-based scheduling (backend processing time and queue time metrics). This parameter transformation enables the system to detect and respond to malicious behavior based on actual backend impact rather than simple request counting, effectively blocking high-entropy attacks that evade traditional rate limits
3Reliability
If aggressive DoS protection measures are implemented, then attack effectiveness is reduced, but system downtime increases
Solution Approach 1:
The system applies dynamics by implementing adaptive request pacing that continuously adjusts scheduling decisions based on real-time backend utilization metrics. The scheduler dynamically modulates request forwarding rates according to observed backend performance, preventing aggressive static rate limiting while maintaining effective attack mitigation through flexible, condition-based control
Solution Approach 2:
The patent implements self-service by enabling the scheduling system to automatically adjust its behavior based on backend utilization feedback without external intervention. The system autonomously monitors its own performance metrics and modifies request scheduling decisions in real-time, eliminating the need for manual configuration adjustments during attacks and reducing downtime
Data Source
AI summary
In accordance with some aspects of the present disclosure, an apparatus is disclosed. In some embodiments, the apparatus includes a processor and a memory. In some embodiments, the memory includes programmed instructions that, when executed by the processor, cause the apparatus to receive a request from a client; determine family of metrics; schedule the request based on the family of metrics; and in response to satisfying one or more scheduling criteria, send the request to a backend server.