Systems and methods utilizing peer measurements to detect and defend against distributed denial of service attacks
First Claim
1. A method, operated by a Software Defined Networking (SDN) controller associated with an Autonomous System (AS) comprising one or more peering points, each peering point comprising an associated router communicatively coupled to the SDN controller, the method for detecting and defending against Distributed Denial of Service (DDoS) attacks, and the method comprising:
- receiving data from the one or more peering points;
detecting malicious traffic at the one or more peering points;
determining a peer quality measurement for the one or more peering points, wherein the peer quality measurement is based on a summation of average traffic plus detected malicious traffic divided by a summation of average traffic, wherein the average traffic and the malicious traffic are across all of the one or more eering points between the Autonomous System and other Autonomous Systems, wherein the peer quality measurement incorporates all types of Bandwidth Amplification Factor (BAF) information in the DDoS attacks, and wherein the malicious traffic is detected based on addresses detected through the SDN controller;
communicating the peer quality measurement associated with the malicious traffic to one or more other SDN controllers associated with the other Autonomous Systems connected through the one or more peering points, wherein a feedback loop with feedback between the Autonomous System and the other Autonomous Systems is utilized to converge the peer quality measurement back to a nominal level based on historical monitoring for the average traffic between the Autonomous System and the other Autonomous Systems through the SDN controller; and
recalculating the peer quality measurement for the one or more peering points subsequent to the feedback loop and continuing communicating the recalculated peer quality measurement until the peer quality measurement is back to the nominal level.
1 Assignment
0 Petitions
Accused Products
Abstract
A method, operated by a Software Defined Networking (SDN) controller associated with an Autonomous System (AS) with one or more peering points, each peering point with an associated router communicatively coupled to the SDN controller, the method for detecting and defending against Distributed Denial of Service (DDoS) attacks, and the method includes receiving data from the one or more peering points; detecting malicious traffic at the one or more peering points; determining a peer quality measurement for the one or more peering points; and communicating the peer quality measurement and other data associated with the malicious traffic to one or more other SDN controllers, associated with Autonomous Systems connected through the one or more peering points, to facilitate convergence of the peer quality measurement back to a nominal level.
18 Citations
12 Claims
-
1. A method, operated by a Software Defined Networking (SDN) controller associated with an Autonomous System (AS) comprising one or more peering points, each peering point comprising an associated router communicatively coupled to the SDN controller, the method for detecting and defending against Distributed Denial of Service (DDoS) attacks, and the method comprising:
-
receiving data from the one or more peering points; detecting malicious traffic at the one or more peering points; determining a peer quality measurement for the one or more peering points, wherein the peer quality measurement is based on a summation of average traffic plus detected malicious traffic divided by a summation of average traffic, wherein the average traffic and the malicious traffic are across all of the one or more eering points between the Autonomous System and other Autonomous Systems, wherein the peer quality measurement incorporates all types of Bandwidth Amplification Factor (BAF) information in the DDoS attacks, and wherein the malicious traffic is detected based on addresses detected through the SDN controller; communicating the peer quality measurement associated with the malicious traffic to one or more other SDN controllers associated with the other Autonomous Systems connected through the one or more peering points, wherein a feedback loop with feedback between the Autonomous System and the other Autonomous Systems is utilized to converge the peer quality measurement back to a nominal level based on historical monitoring for the average traffic between the Autonomous System and the other Autonomous Systems through the SDN controller; and recalculating the peer quality measurement for the one or more peering points subsequent to the feedback loop and continuing communicating the recalculated peer quality measurement until the peer quality measurement is back to the nominal level. - View Dependent Claims (2, 3, 4)
-
-
5. A Software Defined Networking (SDN) controller, associated with an Autonomous System comprising one or more peering points, each peering point comprising an associated router communicatively coupled to the SDN controller, the SDN controller configured to detect and defend against Distributed Denial of Service (DDoS) attacks, the SDN controller comprising:
-
a network interface communicatively coupled to routers associated with the one or more peering points; a processor communicatively coupled to the network interface; and memory storing instructions that, when executed, cause the processor to receive data from the routers associated with the one or more peering points, detect malicious traffic at the routers associated with the one or more peering points, determine a peer quality measurement for the routers associated with the one or more peering points, wherein the peer quality measurement is based on a summation of average traffic plus detected malicious traffic divided by a summation of average traffic, wherein the average traffic and the malicious traffic are across all of the one or more peering points between the Autonomous System and other Autonomous Systems, wherein the peer quality measurement incorporates all types of Bandwidth Amplification Factor (BAF) information in the DDoS attacks, and wherein the malicious traffic is detected based on addresses detected through the SDN controller, communicate the peer quality measurement associated with the malicious traffic to one or more other SDN controllers associated with the other Autonomous Systems connected through the routers associated with the one or more peering points, wherein a feedback loop with feedback between the Autonomous System and the other Autonomous Systems is utilized to converge the peer quality measurement back to a nominal level based on historical monitoring for the average traffic between the Autonomous System and the other Autonomous Systems through the SDN controller, and recalculate the peer quality measurement for the one or more peering points subsequent to the feedback loop and continue communication of the recalculated peer quality measurement until the peer quality measurement is back to the nominal level. - View Dependent Claims (6, 7, 8)
-
-
9. An Autonomous System (AS) configured to detect and defend against Distributed Denial of Service (DDoS) attacks, the AS comprising:
-
one or more routers each associated with one or more peering points with other Autonomous Systems; and a Software Defined Networking (SDN) controller communicatively coupled to the one or more routers, the SDN controller configured to receive data from the one or more routers associated with the one or more peering points, detect malicious traffic at the one or more routers, determine a peer quality measurement for the one or more routers associated with the one or more peering point, wherein the peer quality measurement is based on a summation of average traffic plus detected malicious traffic divided by a summation of average traffic, wherein the average traffic and the malicious traffic are across all of the one or more peering points between the Autonomous System and the other Autonomous Systems, wherein the peer quality measurement incorporates all types of Bandwidth Amplification Factor (BAF) information in the DDoS attacks, and wherein the malicious traffic is detected based on addresses detected through the SDN controller, communicate the peer quality measurement associated with the malicious traffic to one or more other SDN controllers associated with the other Autonomous Systems connected through the one or more routers, wherein a feedback loop with feedback between the Autonomous System and the other Autonomous Systems is utilized to converge the peer quality measurement back to a nominal level based on historical monitoring for the average traffic between the Autonomous System and the other Autonomous Systems through the SDN controller, and recalculate the peer quality measurement for the one or more peering points subsequent to the feedback loop and continue communication of the recalculated peer quality measurement until the peer quality measurement is back to the nominal level. - View Dependent Claims (10, 11, 12)
-
Specification