UDP Application Header Analysis for DDoS Packet Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively distinguish between legitimate and malicious UDP-based DDoS attacks, leading to potential disruption of services and system overload.
Innovation Solution
A system utilizing a modified probabilistic Bloom filter (PMBF) analyzes UDP packet application headers to establish expected values at specific locations, setting an alarm state when unusual patterns are detected, and initiating mitigation actions to block suspected attack packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional packet filtering methods are used to block UDP-based DDoS attacks, then malicious packets can be filtered out, but legitimate traffic may also be blocked and system performance degrades
Solution Approach 1:
The patent changes the parameter of packet inspection from traditional header-only filtering to deep application header value analysis. By examining specific values at defined locations in UDP application headers and comparing them against expected values from the PMBF, the system achieves more precise differentiation between legitimate and malicious traffic, reducing false positives while maintaining attack mitigation effectiveness
Solution Approach 2:
The patent replaces traditional mechanical packet filtering mechanisms with a probabilistic data structure-based system (PMBF). This substitution enables the system to handle large volumes of UDP packets efficiently by using probabilistic matching rather than deterministic rule-based filtering, improving both throughput and accuracy in distinguishing attack traffic from legitimate traffic
2Measurement precision
If deep packet inspection is performed to distinguish legitimate from malicious UDP packets, then detection accuracy improves, but processing time increases and system becomes slower
Solution Approach 1:
The patent performs preliminary action by pre-computing and storing expected application header values for legitimate UDP traffic in the PMBF during normal operation. When an attack occurs, the system can quickly compare incoming packets against these pre-established expectations without performing complex real-time analysis, thus maintaining high detection accuracy while preserving processing speed
Solution Approach 2:
The patent segments the packet inspection process into two phases: a learning phase where the PMBF is trained on legitimate traffic patterns, and a detection phase where packets are quickly classified. This segmentation allows the system to perform comprehensive deep inspection during the learning phase without impacting real-time performance during the detection phase, as the PMBF enables rapid probabilistic matching
3Difficulty of detecting and measuring
If probabilistic data structures are used to track UDP packet patterns, then detection capability improves, but false positive rate increases
Solution Approach 1:
The patent changes the parameter being tracked from simple packet counting to specific application header value frequency analysis. By monitoring the distribution of values at defined locations in UDP application headers and comparing against expected distributions in the PMBF, the system achieves better detection capability while maintaining lower false positive rates through more meaningful pattern recognition
Solution Approach 2:
The patent implements feedback mechanisms where the PMBF is continuously updated with observed legitimate traffic patterns during normal operation. This feedback loop allows the system to adapt to changing legitimate traffic characteristics, improving detection capability while maintaining reliability by learning what normal traffic looks like and using that knowledge to reduce false positives during attack detection
Data Source
AI summary
A method and system for detecting a denial of service (DoS) attack when packets used in the DoS attack are user datagram protocol (UDP) packets, are disclosed. The method includes obtaining values from an application header of a UDP packet; and when, based on use of at least one modified probabilistic Bloom filter (PMBF) for a destination to which the UDP packet indicates that it is destined, the obtained values are not values expected to be found in a UDP packet destined for the destination: increasing an uncommon per sample (ups) estimate for the PMBF; and when the increased uncommon per sample estimate is greater than an upper ups threshold: setting an alarm state to on; suspending update of the PMBF counters; and initiating a mitigation action at least with respect to the UDP packet.