TTL-Based Spoofed Traffic Detection for Low-False-Positive Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network attack detection systems face issues with over-blocking legitimate traffic and computational complexity, particularly in the presence of IP address spoofing, which complicates the differentiation between legitimate and malicious network traffic.
Innovation Solution
A system that builds a CIDR+TTL database by analyzing network traffic patterns to establish expected TTL value ranges for each CIDR block, allowing for efficient authentication of clients by comparing subsequent traffic against these ranges, thereby reducing false positives and computational overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TCP authentication or proxy authentication is implemented to detect spoofed traffic, then detection capability is improved, but legitimate traffic is blocked and computational complexity increases
Solution Approach 1:
The patent extracts only the essential authentication elements (TTL value and CIDR block) from complex authentication protocols like TCP and proxy authentication. By focusing on these two key parameters, the system achieves effective spoofed traffic detection without the computational overhead and false positives associated with full protocol authentication.
Solution Approach 2:
The patent changes the authentication approach from protocol-based verification to parameter-based verification. Instead of performing complex TCP handshakes or proxy authentications, the system compares TTL values and CIDR blocks, which are simpler parameters that can be efficiently checked without blocking legitimate traffic.
2Reliability
If TCP authentication or proxy authentication is implemented, then detection capability is improved, but computational complexity increases
Solution Approach 1:
The patent extracts only the essential authentication elements (TTL value and CIDR block) from complex authentication protocols like TCP and proxy authentication. By focusing on these two key parameters, the system achieves effective spoofed traffic detection without the computational overhead and false positives associated with full protocol authentication.
Solution Approach 2:
The patent uses lightweight, easily obtainable parameters (TTL value and CIDR block) instead of computationally expensive authentication protocols. These parameters can be extracted from packet headers with minimal processing, making the authentication process computationally efficient and suitable for high-speed network environments.
3Reliability
If strict authentication is applied to all traffic, then security is improved, but network throughput decreases due to blocking legitimate traffic
Solution Approach 1:
The patent applies different levels of authentication scrutiny to different traffic based on their TTL values and CIDR blocks. Legitimate traffic with matching TTL-CIDR combinations is allowed through with minimal inspection, while suspicious traffic is subject to closer examination. This localized approach maintains security while preserving network throughput.
Solution Approach 2:
The patent changes the authentication approach from protocol-based verification to parameter-based verification. Instead of performing complex TCP handshakes or proxy authentications, the system compares TTL values and CIDR blocks, which are simpler parameters that can be efficiently checked without blocking legitimate traffic.
Data Source
AI summary
Systems and methods for network traffic monitoring are provided. A system may obtain a data packet of a data packet exchange between the server and a network device, extract a time to live (TTL) value and an internet protocol (IP) address of the network device from the data packet, compare the TTL value with a TTL value range or signature determined based on TTL values observed from data packets transmitted across a communications network, determine that the TTL value violates an authentication policy based on the TTL value being outside of the TTL value range or signature, and apply a tag to the IP address of the network device in a database stored memory.