Virtual Network Stack Traffic Isolation During DoS Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for isolating legitimate network traffic during denial of service (DOS) attacks are inefficient, especially with the rise of source IP address spoofing and distributed attack methods, which can consume system resources and disrupt services without clear detection.
Innovation Solution
A method involving a classifier that directs packets from a network interface card (NIC) to a temporary data structure with a lowest priority queue during suspected attacks, allowing for authentication of subsequent connections and reassignment to a higher priority queue if legitimate, thereby isolating and prioritizing genuine traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional packet filtering and analysis methods are used to identify legitimate traffic during DOS attacks, then traffic can be isolated, but system performance degrades due to pulling packets into main memory and processing each packet individually
Solution Approach 1:
The patent segments the network stack into multiple virtual network stacks, each handling specific traffic flows. By dividing traffic processing into separate virtual stacks with dedicated data structures, the system can process different traffic types in parallel without contending for the same memory resources, thus maintaining high processing performance while accurately isolating legitimate traffic during DOS attacks.
Solution Approach 2:
The patent introduces a new dimension of processing by implementing parallel virtual network stacks that operate simultaneously. Instead of processing all packets sequentially in a single stack, multiple virtual stacks process different traffic flows concurrently, adding temporal and structural dimensions to packet processing that eliminate the traditional performance penalty of individual packet analysis.
2Reliability
If overprovisioning is used to handle excess loads from DOS attacks, then service availability is maintained, but resource costs increase
Solution Approach 1:
The patent implements dynamic resource allocation through virtual network stacks that can be created, activated, or deactivated based on real-time traffic conditions. During normal operation, fewer virtual stacks are active, conserving resources. During DOS attacks, additional virtual stacks are dynamically created to handle attack traffic separately, maintaining service availability without permanently overprovisioning resources.
Solution Approach 2:
The system changes operational parameters by adjusting the number and configuration of active virtual network stacks based on detected attack conditions. When a DOS attack is detected, parameters such as stack priority, data structure allocation, and processing thresholds are dynamically modified to prioritize legitimate traffic while efficiently managing limited resources without permanent overprovisioning.
3Difficulty of detecting and measuring
If source IP address spoofing and distributed attack methods are used by attackers, then attack detection becomes more difficult, but legitimate traffic patterns can be learned for better identification
Solution Approach 1:
The patent implements feedback mechanisms where the system continuously monitors traffic patterns across virtual network stacks and adjusts classification rules dynamically. By analyzing traffic behavior over time and providing feedback to the classification engine, the system learns legitimate traffic patterns even when source IP spoofing is used, improving identification accuracy without increasing detection difficulty for attackers.
Solution Approach 2:
The system performs preliminary classification and routing decisions at the network stack level before packets reach the application layer. By pre-processing and pre-classifying traffic into appropriate virtual stacks based on connection state and flow characteristics, the system establishes legitimate traffic patterns early in the connection lifecycle, enabling accurate identification even when attacker IP addresses are spoofed or distributed.
Data Source
AI summary
A method for isolating legitimate network traffic during a denial of service attack involves receiving a plurality of packets from a network, detecting an attack from the network on a first virtual network stack, wherein the attack on the first virtual network stack comprises at least one from the group consisting of the denial of service attack and an extreme network load, if the attack is detected, forwarding a plurality of packets associated with a subsequent connection to a temporary data structure associated with a second virtual network stack, wherein the second virtual network stack is a lowest priority queue configured at connection setup time, determining whether the subsequent connection is legitimate, and forwarding at least one of the plurality of packets associated with the subsequent connection to a temporary data structure associated with the first virtual network stack if the subsequent connection is legitimate, wherein a higher priority mapping is assigned by a classifier to the subsequent connection.