Method and system for reconstructing a path taken by undesirable network traffic through a computer network from a source of the traffic

• US 20020032793A1
• Filed: 05/15/2001
• Published: 03/14/2002
• Est. Priority Date: 09/08/2000
• Status: Abandoned Application

• Current Assignee: Board of Regents of the University of Michigan (University of Michigan)
• Original Assignee: Board of Regents of the University of Michigan (University of Michigan)
• Inventors: Malan, Gerald R., Jahanian, Farnam
• Application Number:
  US09/855,810
• Publication Number:
  US 20020032793A1
• Time in Patent Office: Days
• US Class Current: 709/232
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method and system for reconstructing a path taken by undesirable network traffic through a computer network from a source of the traffic is provided. The method includes collecting statistics at a plurality of measurement points located within forwarding infrastructure of the computer network. The method also includes analyzing the statistics to reconstruct the path taken by the undesirable network traffic through the network from the source of the traffic. The method and system use a combination of well-known misuse signatures of network resources in combination with modeling of normal network service behavior to identify bandwidth anomalies.

Claims

1. A method for reconstructing a path taken by undesirable network traffic through a computer network from a source of the traffic, the method comprising:

collecting statistics at a plurality of measurement points located within forwarding infrastructure of the computer network; and

analyzing the statistics to reconstruct the path taken by the undesirable network traffic through the network from the source of the traffic.

2. The method as claimed in claim 1 further comprising blocking undesirable network traffic within the computer network upstream of the points based on the reconstructed path.

3. The method as claimed in claim 1 wherein the forwarding infrastructure includes at least one router.

4. The method as claimed in claim 1 wherein the statistics include flow-based statistics which provide information related to the same logical traffic flow.

5. The method as claimed in claim 1 wherein the statistics include packet statistics which provide information about a set of packets entering the forwarding infrastructure.

6. The method as claimed in claim 1 further comprising requesting and receiving upstream statistics from forwarding infrastructure of the computer network upstream the measurement points and wherein the step of analyzing includes the step of analyzing the upstream statistics to reconstruct the path taken by the undesirable network traffic.

7. The method as claimed in claim 1 wherein the step of analyzing includes the step of extracting profiles from the statistics collected at the plurality of measurement points and comparing the profiles to reconstruct the path taken by the undesirable network traffic.

8. The method as claimed in claim 1 wherein the computer network is the Internet.

17. The method as claimed in claim 1 wherein the undesirable network traffic includes denial of service attacks.

9. A system for reconstructing a path taken by undesirable network traffic through a computer network from a source of the traffic, the system comprising:

collectors for collecting statistics at a plurality of measurement points located within forwarding infrastructure of the computer network; and

at least one controller in communication with the collectors for analyzing the statistics to reconstruct the path taken by the undesirable network traffic through the network from the source of the traffic.

10. The system as claimed in claim 9 further comprising means in communication with the at least one controller for blocking undesirable network traffic within the computer network upstream of the points based on the reconstructed path.

11. The system as claimed in claim 9 wherein the forwarding infrastructure includes at least one router.

12. The system as claimed in claim 9 wherein the statistics include flow-based statistics which provide information related to the same logical traffic flow.

13. The system as claimed in claim 9 wherein the statistics include packet statistics which provide information about a set of packets entering the forwarding infrastructure.

14. The system as claimed in claim 9 further comprising means for requesting and receiving upstream statistics from forwarding infrastructure of the computer network upstream the measurement points and wherein the at least one controller analyzes the upstream statistics to reconstruct the path taken by the undesirable network traffic.

15. The system as claimed in claim 9 wherein the controller extracts profiles from the statistics collected at the plurality of measurement points and compares the profiles to reconstruct the path taken by the undesirable network traffic.

16. The system as claimed in claim 9 wherein the computer network is the Internet.

18. The method as claimed in claim 17 wherein the computer network includes a plurality of service provider networks.

19. The system as claimed in claim 9 wherein the undesirable network traffic includes denial of service attacks.

20. The system as claimed in claim 19 wherein the computer network includes a plurality of service provider networks.