Architecture to thwart denial of service attacks

• US 7,043,759 B2
• Filed: 08/16/2001
• Issued: 05/09/2006
• Est. Priority Date: 09/07/2000
• Status: Expired due to Term

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Mazu Networks, Inc. (Riverbed Technology Incorporated)
• Inventors: Kohler, Edward W. Jr., Poletto, Massimiliano Antonio, Kaashoek, Marinus Frans
• Primary Examiner(s): Wright, Norman M.
• Application Number:
  US09/931,561
• Publication Number:
  US 20020035683A1
• Time in Patent Office: 1,727 Days
• Field of Search: 713/200, 713/201, 726/26, 726/25, 726/24, 726/23, 726/22, 726/7, 726/3, 726/11
• US Class Current: 726/25
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A system architecture for thwarting denial of service attacks on a victim data center is described. The system includes a first plurality of monitors that monitor network traffic flow through the network. The first plurality of monitors is disposed at a second plurality of points in the network. The system includes a central controller that receives data from the plurality of monitors, over a hardened, redundant network. The central controller analyzes network traffic statistics to identify malicious network traffic. In some embodiments of the system, a gateway device is disposed to pass network packets between the network and the victim site. The gateway is disposed to protect the victim site, and is coupled to the control center by the redundant hardened network.

Claims

1. A method of thwarting denial of service attacks on a victim data center coupled to a network, the method comprising:

monitoring network traffic through monitors disposed at a plurality of points in the network;

communicating data from the monitors to a central controller, over a redundant network that is a different network from the network being monitored;

analyzing the data comprising network traffic statistics to identify network traffic that is part of a denial of service attack; and

filtering the network traffic based on results of analyzing the network traffic to discard network traffic that is identified as part of the denial of service attack.

2. The method of claim 1, further comprising:

arranging the monitors and central controller to be coupled to the redundant network that is inaccessible to the denial of service attack.

3. The method of claim 1 further comprising:

monitoring network traffic at an edge of the network to protect the data center, with monitoring using a gateway that passes network packets, the gateway disposed at the edge of the network, and with the gateway coupled to the control center by the redundant network.

4. The method of claim 3 wherein monitoring network traffic through the gateway occurs at network entry points of victim data centers.

5. The method of claim 1 wherein analyzing further comprises:

performing intelligent traffic analysis based on collected statistical data from the monitors and filtering further comprises filtering the traffic according to the traffic analysis to eliminate the traffic identified as part of the denial of service attack.

6. The method of claim 5 wherein performing intelligent traffic analysis and filtering, further comprises performing intelligent traffic analysis and filtering by the gateways and the control center.

7. The method of claim 5 wherein performing intelligent traffic analysis and filtering, further comprises performing intelligent traffic analysis and filtering by the gateways.

8. The method of claim 1 wherein monitoring network traffic further comprises monitoring network traffic by data collectors sampling packet traffic and accumulating and collecting statistical information about network flows and the method further comprises:

aggregating packet traffic and accumulated statistical information in the control center to coordinate measures to track down and block the sources of an attack.

9. The method of claim 8 wherein monitoring network traffic further comprises monitoring network traffic at major peering points and network points of presence.

10. The method of claim 1 further comprising:

aggregating traffic information in the control center to coordinate measures to track down and block the sources of an attack.

11. A distributed system to thwarting denial of service attacks comprises:

a plurality of monitors dispersed throughout a network, the monitors collecting statistical data for performance of intelligent traffic analysis and filtering to identify malicious traffic and to eliminate the malicious traffic to thwart the denial of service attack.

12. The distributed system of claim 11 further comprising:

a control center coupled to the plurality of data collectors by a hardened redundant connection to communicate the data to the control center; and

wherein the control centers performs the intelligent traffic analysis to identify the malicious traffic.

13. The distributed system of claim 12 further comprising:

at least one gateway device that passes network packets between the network and the victim site, the gateway disposed to protect a victim site, and being coupled to the control center by the redundant hardened network.

14. A system for thwarting denial of service attacks on a victim data center coupled to a network comprises:

a first plurality of monitors that monitor network traffic flow through the network, the first plurality of monitors disposed at a second plurality of points in the network; and

a central controller that receives data from the plurality of monitors, over a different redundant network, the central controller analyzing network traffic statistics to identify malicious network traffic and to coordinate the first plurality of monitors to filter the network traffic based on results of analyzing the network traffic to discard network traffic that is identified as malicious traffic.

15. The system of claim 14 wherein the different, redundant network is inaccessible to the attack.

16. The system of claim 14 further comprising:

at least one gateway that passes network packets between the network and the victim data center, the gateway disposed to protect potential victim data center and being coupled to the control center by the different, redundant network.

17. The system of claim 16 wherein the gateway is disposed at an edge of the network at victim data center.

18. The system of claim 16 wherein the gateway analyzes network traffic statistics to identify malicious network traffic and filters the network traffic based on results of analyzing the network traffic to discard network traffic that is identified as malicious network traffic during analyzing of the network traffic.

19. The system of claim 16 wherein the gateway is located at the edge of the network that is an entry point to the victim data center.

20. The system of claim 16 wherein both the gateway and the control center perform intelligent traffic analysis and filtering to identify the malicious traffic and to eliminate the malicious traffic.

21. The system of claim 16 wherein the gateway includes a process to allow an administrator to insert filters to discard packets that are deemed to be part of an attack, as determined by heuristics of the traffic flow.

22. The system of claim 14 wherein the data collectors sample packet traffic, and accumulate and collect statistical information about network flows.

23. The system of claim 14 wherein the data collectors are located at major peering points and network points of presence.

24. The system of claim 16 wherein the data collectors sample packet traffic, and accumulate and collect statistical information about network flows and are located at major peering points and network points of presence.

25. The system of claim 16 wherein the control center aggregates traffic information and coordinates measures to track down and block the sources of an attack.

26. The system of claim 16 wherein the gateway includes a process to communicate with the control center over the different, redundant network.

27. A distributed system to thwart denial of service attacks comprises:

a plurality of gateways dispersed throughout a network, near data centers that might be sources of an attack, the gateways collecting statistical data for performance of intelligent traffic analysis and filtering, identify malicious traffic at the source of an attack, to eliminate the malicious traffic and thwart the denial of service attack.

28. The distributed system of claim 27 further comprising:

a control center coupled to the plurality of gateways by a different, redundant network to communicate the data from the gateways to the control center, with the control center performing the intelligent traffic analysis to identify the malicious traffic.

29. The distributed system of claim 27 further comprising:

a first plurality of monitors that monitor network traffic flow through the network, the first plurality of monitors disposed at a second plurality of points in the network; and

a central controller that receives data from the plurality of monitors, over a redundant network that is a different network from the network monitored by the monitors, the central controller analyzing network traffic statistics to identify malicious network traffic.

30. The system of claim 28 wherein the gateways include a process to communicate with the control center over the different, redundant network.

31. The distributed system of claim 27 wherein the gateways are disposed at an edge of the network at the victim data centers.

32. The system of claim 27 wherein the gateways analyze network traffic statistics to identify malicious network traffic and filter the network traffic based on results of analyzing the network traffic to discard network traffic that is identified as malicious network traffic during analyzing of the network traffic.

33. The system of claim 27 wherein the gateway is located at the edge of the network that is an entry point to the victim data center.

34. The system of claim 28 wherein both the gateways and the control center perform intelligent traffic analysis and filtering to identify the malicious traffic and to eliminate the malicious traffic.

35. The system of claim 27 wherein the gateways include a process to allow an administrator to insert filters to discard packets that are deemed to be part of an attack, as determined by heuristics of the traffic flow.