METHOD AND APPARATUS FOR MITIGATING DISTRIBUTED DENIAL OF SERVICE ATTACKS

• US 20150058976A1
• Filed: 08/26/2013
• Published: 02/26/2015
• Est. Priority Date: 08/26/2013
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: CARNEY, Mark D., PACELLA, Dante J., JACKSON, Jeffrey A., BATES, Andrew L.
• Granted Patent: US 9,197,666 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

An approach for mitigating distributed denial of service (DDoS) attacks includes assigning a set of temporary network addresses to a hostname for a finite period and assigning one or more other sets of temporary network addresses to the hostname in one or more following finite periods, responding to a hostname lookup request based on the set of temporary network addresses, the one or more other sets of temporary network addresses, or a combination thereof that are active, responding to a network address lookup request based on at least one of the set of temporary network addresses and the one or more other sets of temporary network addresses that is associated with a current one of the finite period or the one or more following finite periods, and retiring the set of temporary network addresses, the one or more sets of temporary network addresses, or a combination thereof after a configurable number of finite periods, wherein no further network address or hostname lookup request is served based on the retired set of temporary network addresses, the retired one or more sets of temporary network addresses, or a combination thereof.

Claims

1. A method comprising:

assigning a set of temporary network addresses to a hostname for a finite period and assigning one or more other sets of temporary network addresses to the hostname in one or more following finite periods;

responding to a hostname lookup request based on the set of temporary network addresses, the one or more other sets of temporary network addresses, or a combination thereof that are active;

responding to a network address lookup request based on at least one of the set of temporary network addresses and the one or more other sets of temporary network addresses that is associated with a current one of the finite period or the one or more following finite periods; and

retiring the set of temporary network addresses, the one or more sets of temporary network addresses, or a combination thereof after a configurable number of finite periods,

wherein no further network address or hostname lookup request is served based on the retired set of temporary network addresses, the retired one or more sets of temporary network addresses, or a combination thereof.

2. A method of claim 1, further comprising:

selecting the set of temporary network addresses, the one or more other sets of temporary network addresses, or a combination thereof randomly from a pool of available temporary network addresses.

3. A method of claim 1, further comprising:

selecting the set of temporary network addresses, the one or more other sets of temporary network addresses, or a combination thereof based on network traffic information, server load information, server proximity information, or a combination thereof.

4. A method of claim 1, further comprising:

maintaining a record of one or more requestors associated with the hostname lookup request, the network address lookup request, or a combination thereof,

wherein the record includes one or more requestor network addresses, one or more requestor hostnames, one or more temporary network addresses, or a combination thereof.

5. A method of claim 4, further comprising:

determining a potentially malicious attack directed to an assigned temporary network address; and

identifying one or more potentially malicious requestors based on the record.

6. A method of claim 5, wherein the potentially malicious attack is a distributed denial of service (DDoS) attack.

7. A method of claim 1, further comprising:

determining a reputation score of a requestor associated with the hostname lookup request, the network address lookup request, or a combination thereof,

wherein a response to the hostname lookup request, the network address lookup request, or a combination thereof is based on the reputation score.

8. A method of claim 1, further comprising:

inspecting network traffic directed to an assigned temporary network address; and

performing one or more mitigating actions if the network traffic matches an attack profile,

wherein the one or more mitigating actions include dropping the network traffic, transmitting a connection reset message, forwarding the traffic to a black hole server, or a combination thereof.

9. An apparatus configured to:

assign a set of temporary network addresses to a hostname for a current finite period and assign one or more other sets of temporary network addresses in one or more following finite periods;

respond to a hostname lookup request in the current finite period based on the assigned set of temporary network addresses and one or more previously assigned sets of temporary network addresses;

respond to a network address lookup request in the current finite period based on the assigned set of temporary network addresses; and

retire the assigned set of temporary network addresses after a configurable number of finite periods.

10. An apparatus according to claim 9, wherein the apparatus is further caused to:

select the set of temporary network addresses randomly from a pool of available temporary network addresses.

11. An apparatus according to claim 9, wherein the apparatus is further caused to:

select the set of temporary network addresses based on network traffic information, server load information, server proximity information, or a combination thereof.

12. An apparatus according to claim 9, wherein the apparatus is further caused to:

maintain a record of one or more requestors associated with network address lookup request,

wherein the record includes one or more requestor network addresses, one or more requestor hostnames, one or more temporary network addresses, or a combination thereof.

13. An apparatus according to claim 12, wherein the apparatus is further caused to:

determine a potentially malicious attack directed to an assigned temporary network address; and

identify one or more potentially malicious requestors based on the record.

14. An apparatus according to claim 13, wherein the potentially malicious attack is a distributed denial of service (DDoS) attack.

15. An apparatus according to claim 9, wherein the apparatus is further caused to:

determine a reputation score of a requestor associated with the network address and hostname lookup requests,

wherein a response to the network address and hostname lookup requests is based on the reputation score.

16. An apparatus according to claim 9, wherein the apparatus is further caused to:

inspect network traffic directed to an assigned temporary network address; and

perform one or more mitigating actions if the network traffic matches an attack profile,

wherein the one or more mitigating actions include dropping the network traffic, transmitting a connection reset message, forwarding the traffic to a black hole server, or a combination thereof.

17. A system comprising:

a mitigation platform configured to assign a set of temporary network addresses to a hostname for a current finite period and assign one or more other sets of temporary network addresses in one or more following finite periods, respond to a hostname lookup request in the current finite period based on the assigned set of temporary network addresses and one or more previously assigned sets of temporary network addresses, respond to a network address lookup request in the current finite period based on the assigned set of temporary network addresses, and retire the assigned set of temporary network addresses after a configurable number of finite periods.

18. A system according to claim 17, wherein the mitigation platform is further configured to select the set of temporary network addresses randomly from a pool of available temporary network addresses.

19. A system according to claim 17, wherein the mitigation platform is further configured to select the set of temporary network addresses based on network traffic information, server load information, server proximity information, or a combination thereof.

20. A system according to claim 17, wherein the mitigation platform is further configured to maintain a record of one or more requestors associated with network address lookup request,

wherein the record includes one or more requestor network addresses, one or more requestor hostnames, one or more temporary network addresses, or a combination thereof.