Two-Stage Hash Attribution for Application Layer DDoS Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for mitigating application layer Distributed Denial of Service (DDoS) attacks struggle to efficiently identify and attribute attacks involving large, variable-size strings such as user-agents, hosts, and URLs in real-time, due to limitations in processing power and memory usage.
Innovation Solution
A two-stage hashing scheme is employed to attribute DDoS attacks, where a first-stage hash index with limited memory usage identifies potentially attacked parameters, and a second-stage table refines attribution by using granular traffic rate monitoring and adaptive thresholds to determine actual attack status, allowing for efficient packet dropping and source IP blocking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current methods are used to identify and attribute application layer DDoS attacks involving large variable-size strings, then attack attribution can be achieved, but processing power and memory usage become excessive and real-time identification is not possible
Solution Approach 1:
The patent transforms the original large variable-size strings (user-agents, hosts, URLs) into fixed-size hash values. This parameter transformation changes the data representation from variable-length strings to fixed-length hashes, enabling efficient storage and comparison while maintaining the ability to identify attacked parameters. The hash function maps complex strings to compact numerical representations that can be processed in real-time.
Solution Approach 2:
The patent creates a simplified copy of the original data through hashing. Instead of storing and comparing the full variable-size strings, the system stores and compares hash copies of these strings. This copying approach maintains the essential identifying characteristics while dramatically reducing the computational resources required for attack attribution.
2Reliability
If large variable-size strings are monitored for attack attribution, then specific attacks can be identified, but memory table capacity requirements increase significantly
Solution Approach 1:
The patent applies parameter transformation by converting variable-size strings into fixed-size hash values. This transformation fundamentally changes the memory requirements from storing large variable-length data to storing compact fixed-length hashes, dramatically reducing the quantity of memory resources needed while preserving the ability to accurately identify attacked parameters.
Solution Approach 2:
The patent extracts only the essential identifying characteristics of the attacked parameters through hashing. Instead of storing the complete variable-size strings, the system extracts and stores only the hash representations, which contain sufficient information for attack identification while occupying minimal memory space.
3Measurement precision
If granular traffic rate monitoring is implemented for multiple monitored hashes, then false positives are minimized, but processing complexity increases
Solution Approach 1:
The patent segments the attack detection process into distinct stages: hashing the monitored parameters, storing the hash values, monitoring traffic rates for each hash, and comparing against thresholds. This segmentation breaks down the complex task of attack detection into manageable, independent steps, reducing overall processing complexity while maintaining high detection accuracy through granular monitoring.
Data Source
AI summary
Methods and systems for a two-stage attribution of application layer DDoS attack are provided. In a first table just a hash index is maintained whereas the second stage table keeps the string parameter corresponding to the application layer attribute under attack. A linked list maintains a plurality of rows if there is hash collision in the first table. The second table is aged out and reported periodically with details of large strings.