System, method, and computer program for isolating services of a communication network in response to a distributed denial of service (DDoS) attack

A computer program product embodied on a non-transitory computer readable medium, comprising:

• computer code for receiving an indication of detection of a distributed denial of service (DDoS) attack directed at one or more resources of a network function virtualization-based (NFV-based) communication network;
• computer code for identifying a first network service associated with the NFV-based communication network that is subject to the DDoS attack, the first network service being implemented as at least one virtual network function (VNF) executing on a first network cloud having a first plurality of network servers for use by one or more clients;
• computer code for identifying a second network service associated with the NFV-based communication network that is chained to the first network service but is not subject to the DDoS attack, the second network service being implemented as at least one second VNF executing on the first network cloud and being chained to the first network service to together perform work for a client of the one or more clients;
• computer code, responsive to identifying that the first network service is subject to the DDos attack, for:
• determining to isolate the first network service by migrating the first network service and the second network service, wherein the determination is based on a cost of migrating the first network service and the second network service,
• migrating the first network service from the first network cloud to a second network cloud having a second plurality of network servers to implement the first network service as the at least one VNF executing on the second network cloud for use by the one or more clients, and
• migrating the second network service from the first network cloud to the second network cloud.

A system comprising:

• a memory system;
• and
• one or more processing cores coupled to the memory system and that are each configured to:
• receive an indication of detection of a distributed denial of service (DDoS) attack directed at one or more resources of a network function virtualization-based (NFV-based) communication network;
• identify a first network service associated with the NFV-based communication network that is subject to the DDoS attack, the first network service being implemented as at least one virtual network function (VNF) executing on a first network cloud having a first plurality of network servers for use by one or more clients;
• identify a second network service associated with the NFV-based communication network that is chained to the first network service but is not subject to the DDoS attack, the second network service being implemented as at least one second VNF executing on the first network cloud and being chained to the first network service to together perform work for a client of the one or more clients;
• responsive to identifying that the first network service is subject to the DDos attack:
• determine to isolate the first network service by migrating the first network service and the second network service, wherein the determination is based on a cost of migrating the first network service and the second network service,
• migrate the first network service from the first network cloud to a second network cloud having a second plurality of network servers to implement the first network service as the at least one VNF executing on the second network cloud for use by the one or more clients, and
• migrate the second network service from the first network cloud to the second network cloud.