Systems and methods for detecting and preventing flooding attacks in a network environment

• US 9,065,847 B2
• Filed: 05/20/2014
• Issued: 06/23/2015
• Est. Priority Date: 07/06/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Wei, Shaohong, Duan, Gang, Chen, Zhong Qiang, Xie, Bing
• Primary Examiner(s): Jiang, Charles C
• Assistant Examiner(s): KAMARA, MOHAMED A
• Application Number:
  US14/282,876
• Publication Number:
  US 20140259163A1
• Time in Patent Office: 399 Days
• Field of Search: 370229-230, 370/232, 370/252, 726/1, 726/3, 726 11- 14, 726 22- 23, 726 26- 30, 709223-225, 709/230, 709/232, 709245-246
• US Class Current: 1/1
• CPC Class Codes: H04L 1/1835 Buffer management
• CPC Class Codes: H04L 2463/143 Denial of service attacks involving systematic or selective dropping of packets
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A method for processing network traffic data includes receiving a packet, and determining whether the packet or a session of the packet is associated with a flooding attack. Some embodiments are implemented on network switching devices.

Claims

1. A method for processing network traffic content performed on a network switching device, comprising:

receiving, via a network interface of the network switching device, a packet associated with a new network traffic session;

identifying, on the network switching device, one or more Internet Protocol (IP) addresses associated with the new network traffic session;

determining, on the network switching device, a number of concurrent sessions associated with at least one of the one or more IP address associated with the new network traffic session; and

when the determined number of concurrent sessions is greater than a concurrent IP address session threshold, performing flooding attack mitigation processing at least in part on the network switching device, wherein the concurrent IP address session threshold is learned based on processing of stored packet history log data that determines the concurrent IP address session threshold.

2. The method of claim 1, wherein the flooding attack mitigation processing includes the network switching device dropping all packets associated with the new network traffic session.

3. The method of claim 1, wherein the flooding attack mitigation processing includes the network switching device dropping all packets associated with the at least one IP address.

4. The method of claim 1, wherein:

identifying the one or more IP addresses of the new network traffic session further includes the network switching device identifying a packet-type of the received packet;

determining the number of concurrent sessions includes determining, on the network switching device, a number of concurrent sessions of a type of network traffic sessions identified by the identified packet type; and

the concurrent IP address session threshold is network traffic session-type specific.

5. The method of claim 1, wherein the concurrent IP address session threshold is IP address adaptive.

6. The method of claim 1, wherein the concurrent IP address session threshold is time of day adaptive.

7. The method of claim 1, wherein the concurrent IP address session threshold is IP address and time of day adaptive.

8. A network switching device, comprising:

a processor;

a set of network interfaces for communicating over at least one network;

a memory device including instructions stored thereon which when executed by the processor, cause the network switching device to;

receive, via a network interface of the set of network interfaces, a packet associated with a new network traffic session;

identify one or more Internet Protocol (IP) addresses associated with the new network traffic session;

determine a number of concurrent sessions associated with at least one of the one or more IP address associated with the new network traffic session; and

when the number of concurrent sessions associated with the at least one of the one or more IP addresses associated with the new network traffic session is greater than a concurrent IP address session threshold, perform flooding attack mitigation processing, wherein the concurrent IP address session threshold is learned based on processing of stored packet history log data that determines the concurrent IP address session threshold.

9. The network switching device of claim 8, wherein the flooding attack mitigation processing includes the network switching device dropping all packets associated with the new network traffic session.

10. The network switching device of claim 8, wherein the flooding attack mitigation processing includes the network switching device dropping all packets associated with the at least one IP address.

11. The network switching device of claim 8, wherein:

identifying the one or more IP addresses the new network traffic session further includes identifying a packet-type of the received packet;

determining a number of concurrent sessions associated with at least one of the one or more IP address associated with the new network traffic session includes determining a number of concurrent sessions of a type of network traffic sessions identified by the identified packet type; and

the concurrent IP address session threshold is network traffic session-type specific.

12. The network switching device of claim 8, wherein the concurrent IP address session threshold is IP address adaptive.

13. The network switching device of claim 8, wherein the concurrent IP address session threshold is time of day adaptive.

14. The network switching device of claim 8, wherein the concurrent IP address session threshold is IP address and time of day adaptive.

15. A computer-readable storage device including a set of instructions stored thereon which when executed by a processor of a network switching device cause the network switching device to:

receive, on the network switching device via a network interface of a plurality of network interfaces of the network switching device, a packet associated with a new network traffic session;

identify, on the network switching device, one or more Internet Protocol (IP) addresses associated with the new network traffic session;

determine, on the network switching device, a number of concurrent sessions associated with at least one of the one or more IP address associated with the new network traffic session; and

when the number of concurrent sessions associated with the at least one of the one or more IP addresses associated with the new network traffic session is greater than a concurrent IP address session threshold, perform flooding attack mitigation processing on the network switching device, wherein the concurrent IP address session threshold is learned based on processing of stored packet history log data that determines the concurrent IP address session threshold.

16. The computer-readable storage device of claim 15, wherein the flooding attack mitigation processing includes the network switching device dropping all packets associated with the new network traffic session.

17. The computer-readable storage device of claim 15, wherein the flooding attack mitigation processing includes the network switching device dropping all packets associated with the at least one IP address.

18. The computer-readable storage device of claim 15, wherein:

identifying the one or more IP addresses the new network traffic session further includes identifying a packet-type of the received packet;

determining a number of concurrent sessions associated with at least one of the one or more IP address associated with the new network traffic session includes determining a number of concurrent sessions of a type of network traffic sessions identified by the identified packet type; and

the concurrent IP address session threshold is network traffic session-type specific.

19. The computer-readable storage device of claim 15, wherein the concurrent IP address session threshold is IP address adaptive.

20. The computer-readable storage device of claim 15, wherein the concurrent IP address session threshold is time of day adaptive.