Traffic Suppression System for DDoS Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed Denial of Service (DDoS) attacks overwhelm target devices, causing service failures due to excessive network traffic, which routers along the path also suffer from, as they are not designed to perform analytics and have limited views of the data, making it difficult to detect and respond to such attacks effectively.
Innovation Solution
Implementing systems and methods within target devices or network monitoring services to detect overload conditions, generate traffic suppression requests including source-destination tuples, and configure routers to filter out matching traffic, using ephemeral filters that automatically expire, thereby reducing traffic and normalizing network operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If routers carry and forward all network traffic including attack traffic, then traffic delivery function is maintained, but router performance deteriorates and they suffer from overload
Solution Approach 1:
The harmful attack traffic is extracted and removed from the network path at the ingress point before being forwarded to the target. The system identifies malicious traffic patterns and selectively drops packets matching attack signatures, allowing legitimate traffic to continue flowing while preventing attack traffic from consuming router resources along the path.
Solution Approach 2:
An intermediary traffic analysis system is introduced between the attack source and the target, as well as between attack traffic and routers. This intermediary component performs specialized traffic analysis and filtering, protecting routers from having to process and analyze attack traffic while maintaining their primary packet forwarding function.
2Difficulty of detecting and measuring
If target device performs analytics on incoming traffic to detect DDoS attacks, then attack detection capability is improved, but target device becomes overwhelmed and service failure occurs
Solution Approach 1:
The traffic analysis function is segmented and separated from the target device. Instead of the target device performing all traffic analytics, the system divides the detection function across multiple components: ingress point routers perform initial traffic analysis, intermediate routers forward analysis data, and a dedicated traffic analysis system performs comprehensive attack detection. This segmentation prevents any single device from being overwhelmed.
Solution Approach 2:
A dedicated traffic analysis system acts as an intermediary between the network traffic and the target device. This intermediary performs comprehensive traffic analytics and attack detection, then provides filtered results to the target device without requiring the target to process raw traffic data itself, thus maintaining service availability while improving detection capability.
3Speed
If target device responds to DDoS attacks in real-time, then attack response effectiveness is improved, but target device cannot respond due to being overwhelmed
Solution Approach 1:
Traffic filtering rules and attack detection mechanisms are pre-configured and established before attacks occur. Routers are pre-programmed with traffic analysis capabilities and filtering policies, enabling them to immediately recognize and block attack traffic without requiring real-time decision-making by the overwhelmed target device. This preliminary preparation ensures rapid response while maintaining target device responsiveness.
4Measurement precision
If routers perform costly analytics on packets, then attack detection precision is improved, but router processing capacity is exceeded and performance degrades
Solution Approach 1:
The packet analytics function is segmented from the router's core forwarding function. Routers perform only essential packet header analysis for routing decisions, while detailed traffic pattern analysis is performed by dedicated analysis systems. This segmentation allows routers to maintain high processing capacity while the system as a whole achieves high detection precision through specialized analysis components.
Data Source
AI summary
A method for suppressing network traffic includes: detecting an overload condition at a target device in a network; determining a source address of high traffic associated with the overload condition at the target device; generating a traffic suppression request including a source-destination tuple including a source identifier corresponding to the source address and a destination identifier corresponding to an address of the target device; sending the traffic suppression request to a router; configuring the router with a filter based on the source-destination tuple of the traffic suppression request; and filtering traffic between the source address and the target device based on the configured filter.