Distributed denial of service (DDoS) network-based detection

• US 20070130619A1
• Filed: 12/06/2005
• Published: 06/07/2007
• Est. Priority Date: 12/06/2005
• Status: Abandoned Application

• Current Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Reams, Orin
• Application Number:
  US11/294,979
• Publication Number:
  US 20070130619A1
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Distributed Denial of Service (DDOS) Network-Based Detection. The present invention implements a network-based DDoS detection service. Data is sampled from various customer networks and delivered to a collector. The collector filters the data for those customers that implement or subscribe to the detection service. The filtered data is delivered to an analyzer to determine if the filtered data contains DDoS packets.

Claims

1. A computer system having a processor and a memory, the computer system operable to execute a method for providing a scalable detection for a distributed denial of service (DDoS) attack, the method comprising:

sampling a set of packets destined for one or more entities connected to a packet network wherein the sampled set of packets is delivered to one or more regional collectors;

filtering the sampled set of packets to identify one or more customers wherein the filtered sampled set of packets is associated with the one or more customers;

providing the filtered sampled set of packets from the one or more regional collectors to one or more analyzers;

determining at the one or more analyzers if one or more members of the filtered sampled set of packets are one or more DDoS packets; and

performing at least one of a notification or a mitigation if the one or more members of the filtered sampled set of packets are one or more DDoS packets.

2. The system of claim 1, wherein the one or more entities include one or more other packet networks.

3. The system of claim 1, wherein the one or more customers subscribe to a DDoS detection service.

4. The system of claim 1, wherein determining at the one or more analyzers if the one or more members of the filtered sampled set of packets are the one or more DDoS packets comprises comparing the filtered sampled set of packets to a profile in the one or more analyzers;

5. The system of claim 4, wherein the profile includes a baseline of normal packet traffic for a customer.

6. The system of claim 1, wherein performing the notification comprises providing a notice to at least one of a user, a computing device, and another computer system.

7. The system of claim 6, wherein providing the notice comprises providing an alarm.

8. The system of claim 1, wherein performing the mitigation comprises removing one or more DDoS packets from one or more networks of the one or more customers.

9. The system of claim 1, further comprising adjusting a number of the one or more regional collectors or the one or more analyzers to handle the sampled set of packets or the filtered sampled set of packets.

10. A computer system having a processor and a memory, the computer system operable to execute a method for providing a scalable detection for a distributed denial of service (DDoS) attack, the method comprising:

sampling a set of packets destined for one or more customers wherein the sampled set of packets are provided to a collector;

analyzing the sampled set of packets based on a criteria to filter the one or more customers to provide a subset of the sampled set of packets associated with a subset of the one or more customers to an analyzer;

comparing the subset of the sampled set of packets to a profile in the analyzer to determine if one or more members of the subset of the sampled set of packets exceed a threshold; and

providing a notice to at least one of a user, a computing device, or another computer system when the threshold is exceeded.

11. The system of claim 10, wherein the criteria indicates the subset of the one or more customers subscribe to a DDoS detection service.

12. The system of claim 10, wherein the one or more members of the subset of the sampled set of packets include one or more DDoS packets.

13. The system of claim 12, wherein the threshold includes a limit for a normal traffic pattern.

14. The system of claim 13, further comprising providing more collectors or more analyzers to handle the sampled set of packets or the subset of the sampled set of packets.

15. The system of claim 13, further comprising mitigating the one or more DDoS packets.

16. One or more computer-readable media having computer-readable instructions embodied thereon for causing a computing device to perform a method for providing a scalable detection for a distributed denial of service (DDOS) attack, the method comprising:

sampling a set of packets destined for one or more entities connected to a packet network wherein the sampled set of packets is delivered to one or more regional collectors;

filtering the sampled set of packets to identify one or more customers wherein the filtered sampled set of packets is associated with the one or more customers;

providing the filtered sampled set of packets from the one or more regional collectors to one or more analyzers;

determining at the one or more analyzers if one or more members of the filtered sampled set of packets are one or more DDoS packets; and

performing at least one of a notification or a mitigation if the one or more members of the filtered sampled set of packets are one or more DDoS packets.

17. One or more computer-readable media having computer-readable instructions embodied thereon for causing a computing device to perform a method for providing a scalable detection for a distributed denial of service (DDoS) attack, the method comprising:

sampling a set of packets destined for one or more customers wherein the sampled set of packets are provided to a collector;

analyzing the sampled set of packets based on a criteria for the one or more customers to provide a subset of the sampled set of packets associated with a subset of the one or more customers to an analyzer;

comparing the subset of the sampled set of packets to a profile in the analyzer to determine if one or more members of the subset of the sampled set of packets exceed a threshold; and

providing a notice to at least one of a user, a computing device, or another computer system when the threshold is exceeded.