UDP Attack Defense via ICMP Feedback Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current rate limiting defense methods against UDP attacks often mistakenly discard normal UDP data packets, leading to transmission failures due to their inability to accurately differentiate between legitimate and malicious traffic.
Innovation Solution
A defense device that detects UDP attacks by monitoring network traffic, obtains ICMP error packets from the target host, extracts information about target ports, and performs interception processing on UDP data packets sent to those ports, thereby reducing the likelihood of normal packets being mistakenly discarded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If rate limiting defense is implemented with threshold-based packet analysis, then UDP attack traffic can be limited, but normal UDP data packets are easily and mistakenly discarded
Solution Approach 1:
The patent implements feedback by monitoring ICMP error packets returned to the attack device and using this information to dynamically adjust defense rules. The defense device extracts target port information from ICMP packets and updates interception rules accordingly, creating a closed-loop system that adapts to actual attack patterns while preserving normal traffic to legitimate ports
Solution Approach 2:
The patent uses ICMP error packets as an intermediary to convey information about attacked ports. By analyzing these intermediary packets, the defense device can identify which ports are under attack without directly inspecting every UDP packet, thus distinguishing malicious traffic from normal traffic more accurately
2Productivity
If threshold-based rate limiting is applied to UDP packets, then attack traffic can be controlled, but transmission failures of normal packets occur
Solution Approach 1:
The patent implements dynamic defense rules that adapt based on real-time ICMP feedback. Instead of static threshold-based rate limiting, the system continuously updates interception rules based on observed attack patterns, dynamically adjusting which ports are blocked and at what rates, thereby maintaining productivity in attack control while preserving normal packet delivery
Solution Approach 2:
The patent changes the parameters of defense rules based on extracted ICMP information. By modifying interception thresholds and target port lists dynamically according to observed attack behavior, the system optimizes attack traffic control parameters without compromising normal packet delivery parameters
Data Source
AI summary
Embodiments of the present disclosure disclose a method for defending against a User Datagram Protocol (UDP) attack and a defense device. The method is implemented by a defense device, the defense device comprising a memory, a processor, and a bus system. The method comprising: detecting, by the defense device, whether a target host is attacked by a UDP attack from an attack device; obtaining, by the defense device, an Internet Control Message Protocol (ICMP) data packet sent back by the target host to the attack device, in response to the target host being attacked by the attack device; extracting, by the defense device, information about target ports in the ICMP data packet; and performing, by the defense device according to the information about the target ports, interception processing on UDP data packets sent by the attack device to the target ports.