Automatic handling of device group oversubscription using stateless upstream network devices

A distributed denial of service (DDoS) attack mitigation system comprising:

• a plurality of stateless network devices connected to a network;
• a plurality of Deep Packet Inspection (DPI) devices connected to one or more of the plurality of stateless network devices, each of the plurality of DPI devices configured to detect a DDoS attack and further configured to detect on over-subscription condition caused by a flow of network traffic thereto so as to generate and transmit an over-subscription signal;
• a software defined network (SDN) controller connected to one or more of the plurality of stateless network devices and connected to the plurality of DPI devices, the SDN controller comprising logic integrated with and/or executable by a processor, the logic being configured to:
• receive an over-subscription signal from a first DPI device of the one or more DPI devices;
• analyze the over-subscription signal received from the first DPI device;
• update a network traffic policy;
• send the updated network policy to the plurality of stateless network devices;
• send the updated network policy from the plurality of stateless network devices to the plurality of DPI devices,
• based the updated network policy:
• either i) redirecting at least some of network traffic destined for the first DPI device to one of the plurality of DPI devices different from the first DPI device based upon customer priority prescribed in the network traffic policy associated with network traffic to be diverted to another DPI device;
• or ii) dropping lower network traffic to the first DPI device based on the analyzed over-subscription signal;
• and
• send a signal indicative of the updated network policy to at least some of the plurality of stateless network devices to achieve load-bola acing of the network traffic flowing to the one or more DPI devices.

A method for automatic handling of device group oversubscription, the method comprising steps of:

• receiving, by a controller, an over-subscription signal from a first DPI device of a plurality of DPI devices, wherein the controller is connected to one or more of a plurality of stateless network devices and connected to the plurality of DPI devices;
• analyzing, by the controller, the over-subscription signal received from the first DPI device;
• updating, by the controller, a network traffic policy;
• sending the updated network policy to the plurality of stateless network devices;
• sending the updated network policy from the plurality of stateless network devices to the plurality of DPI devices;
• based the updated network policy:
• either i) redirecting at least some of network traffic destined for the first DPI device to one of the plurality of DPI devices different from the first DPI device update a network traffic policy to either i) redirecting at least some of network traffic destined for the first DPI device to the one or more DPI devices different from the first DPI device based upon customer priority prescribed in the network traffic policy associated with network traffic to be diverted to another DPI device or ii) dropping lower network traffic to the first DPI device based on the analyzed over-subscription signal;
• or ii) dropping lower network traffic to the first DPI device based on the analyzed over-subscription signal;
• and
• sending, by the controller, a signal indicative of the updated network policy to at least some of the plurality of stateless network devices to achieve load-balancing of the network traffic flowing to the one or more DPI devices.