Overlay network for tracking denial-of-service floods in unreliable datagram delivery networks

• US 20060156402A1
• Filed: 03/13/2006
• Published: 07/13/2006
• Est. Priority Date: 12/22/1999
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: WorldCom, Inc. (Verizon Communications Inc.)
• Inventors: Stone, Robert J., Sibley, Matthew J.
• Granted Patent: US 8,234,707 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 45/32 Flooding denial of service attacks H04L63/1458
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

An approach for tracking denial-of-service (DoS) flood attacks using an overlay IP (Internet Protocol) network is disclosed. One or more tracking routers form an overlay tracking network over the network of an Internet Service Provider (ISP). The ISP network includes numerous transit routers and edge routers. The tracking routers communicate directly with all the edge routers using IP tunnels. The edge routers within the ISP network perform security diagnostic functions, in part, to identify a DoS flood attack that has been launched by one or more attackers. To track down an attacker, an egress edge router identifies the DoS flood attack datagrams, rerouting these datagrams to the overlay tracking network. The tracking routers perform hop-by-hop input debugging to identify the ingress edge router associated with the source of the DoS flood attack.

Claims

1-29. -29. (canceled)

30. A method for tracking malicious packets, the method comprising:

establishing a tunnel to each of a plurality of routers to form an overlay network, each of the routers being configured to detect a malicious packet;

receiving the detected malicious packet from one of the routers; and

determining a source of the malicious packet in response to the received detected malicious packet.

31. A method according to claim 30, further comprising:

performing hop-by-hop tracking to locate the source.

32. A method according to claim 30, further comprising:

receiving another detected malicious packet from the one router or another one of the routers; and

determining another source of the malicious packets.

33. A method according to claim 30, wherein the one router utilizes a signature to determine that a received packet is malicious.

34. A method according to claim 30, wherein the overlay tracking network is within an autonomous system that is different from another autonomous system corresponding to the plurality of routers.

35. A method according to claim 30, wherein the tunnels are either physical connections or logical connections.

36. A method according to claim 30, wherein the malicious packet is an Internet Protocol (IP) packet.

37. A method according to claim 30, further comprising:

establishing, via a loop back interface, a connection with a tracking router configured to determine the source of the malicious packet, wherein the connection to the tracking router.

38. An apparatus for tracking malicious packets, the apparatus comprising:

one or more interfaces configured to establish a tunnel to each of a plurality of routers to form an overlay network, each of the routers being configured to detect a malicious packet, wherein a detected malicious packet is received from one of the routers; and

a processor configured to determine a source of the malicious packet in response to the received detected malicious packet.

39. An apparatus according to claim 38, wherein the processor is further configured to perform hop-by-hop tracking to locate the source.

40. An apparatus according to claim 38, wherein another detected malicious packet is received from the one router or another one of the routers, and the processor determines another source of the malicious packets.

41. An apparatus according to claim 38, wherein the one router utilizes a signature to determine that a received packet is malicious.

42. An apparatus according to claim 38, wherein the overlay tracking network is within an autonomous system that is different from another autonomous system corresponding to the plurality of routers.

43. An apparatus according to claim 38, wherein the tunnels are either physical connections or logical connections.

44. An apparatus according to claim 38, wherein the malicious packet is an Internet Protocol (IP) packet.

45. An apparatus according to claim 38, further comprising:

a loop back interface configured to support establishment of a connection with a tracking router configured to determine the source of the malicious packet, wherein termination addresses of the tunnels are prevented from being announced over the connection to the tracking router.

46. A method for tracking malicious packets, the method comprising:

establishing a tunnel with a tracking router configured to form an overlay network with a plurality of routers;

receiving a packet that originated externally from the overlay network;

determining that the received packet is a malicious packet; and

transmitting the detected malicious packet to the tracking router, wherein the tracking router is further configured to determine a source of the malicious packet in response to the received detected malicious packet.

47. A method according to claim 46, wherein the tracking router is further configured to perform hop-by-hop tracking to locate the source.

48. A method according to claim 46, further comprising:

comparing a signature of the received packet with a predetermined signature to determine that the received packet is malicious.

49. A method according to claim 46, wherein the overlay tracking network is within an autonomous system that is different from another autonomous system corresponding to the plurality of routers.

50. A method according to claim 46, wherein the tunnels are either physical connections or logical connections.

51. A method according to claim 46, wherein the malicious packet is an Internet Protocol (IP) packet.

52. An apparatus for tracking malicious packets, the apparatus comprising:

a first communication interface configured to establish a tunnel with a tracking router configured to form an overlay network with a plurality of routers;

a second communication interface configured to receive a packet that originated externally from the overlay network; and

a processor configured to determine that the received packet is a malicious packet, wherein the detected malicious packet is transmitted over the first communication interface to the tracking router, wherein the tracking router is further configured to determine a source of the malicious packet in response to the received detected malicious packet.

53. An apparatus according to claim 52, wherein the tracking router is further configured to perform hop-by-hop tracking to locate the source.

54. An apparatus according to claim 52, wherein the process is further configured to compare a signature of the received packet with a predetermined signature to determine that the received packet is malicious.

55. An apparatus according to claim 52, wherein the overlay tracking network is within an autonomous system that is different from another autonomous system corresponding to the plurality of routers.

56. An apparatus according to claim 52, wherein the tunnels are either physical connections or logical connections.

57. An apparatus according to claim 52, wherein the malicious packet is an Internet Protocol (IP) packet.

58. A system for tracking malicious packets, the system comprising:

a first tracking router configured to establish a tunnel to each of a first set of routers; and

a second tracking router configured to establish a tunnel to each of a second set of routers, wherein each of the routers in the first set and the second set is configured to detect a malicious packet,

wherein the first tracking router and the second tracking router form an overlay network with the routers to determine one or more sources of the malicious packets.

59. A system according to claim 58, wherein the first tracking router includes a loop back interface for establishing a tunnel to a loop back interface of the second tracking router, wherein the tunnel is prevented from transmitting information about addresses of loop back interfaces over the tunnel.