# US 10,771,499 B2 · Automatic handling of device group oversubscription using stateless upstream network devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,499 B2 - Document ID: US10771499B2 - Status: Granted - Kind: B2 - Application number: 15/616,757 - Filed: 2017-06-07 - Published: 2018-12-13 - Granted: 2020-09-08 - Earliest claimed: 2017-06-07 - Assignees: Arbor Networks, Inc. - Applicants: Arbor Networks, Inc. - Inventors: Joshua Graham Knight - Web page: https://patentgrep.com/patent/US10771499B2 ## CPC - H04L 63/1458: {Denial of Service} - H04L 41/0893: Assignment of logical groups to network elements - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 43/028: by filtering - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 41/0894: Policy-based network configuration management - H04L 2463/141: Denial of service attacks against endpoints in a network - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A DDoS attack mitigation system includes a plurality of stateless network devices connected to a network. The system also includes one or more DPI devices connected to the plurality of stateless devices. The system further includes a controller connected to the plurality of stateless devices and connected to the DPI devices. The controller includes logic integrated with and/or executable by a processor. The controller is configured to receive a signal from a first DPI device and analyze the received signal. The controller is further configured to update a network traffic policy to redirect at least some of network traffic destined for the first DPI device to one or more DPI devices different from the first DPI device based on the analyzed signal and to send a signal indicative of the updated network policy to at least some of the plurality of stateless devices. ## Claims ### Claim 1 A distributed denial of service (DDoS) attack mitigation system comprising: a plurality of stateless network devices connected to a network; a plurality of Deep Packet Inspection (DPI) devices connected to one or more of the plurality of stateless network devices, each of the plurality of DPI devices configured to detect a DDoS attack and further configured to detect on over-subscription condition caused by a flow of network traffic thereto so as to generate and transmit an over-subscription signal; a controller connected to one or more of the plurality of stateless network devices and connected to the plurality of DPI devices, the controller comprising logic integrated with or executable by a processor, the logic being configured to; receive an over-subscription signal from a first DPI device of the one or more DPI devices; analyze the over-subscription signal received from the first DPI device; update a network traffic policy; send the updated network policy to the plurality of stateless network devices; send the updated network policy from the plurality of stateless network devices to the plurality of DPI devices; based the updated network policy: either i) redirecting at least some of network traffic destined for the first DPI device to one of the plurality of DPI devices different from the first DPI device based upon customer priority prescribed in the network traffic policy associated with network traffic to be diverted to another DPI device; or ii) dropping lower network traffic to the first DPI device based on the analyzed over-subscription signal; and send a signal indicative of the updated network policy to at least some of the plurality of stateless network devices to achieve load-balancing of the network traffic flowing to the one or more DPI devices. ### Claim 2 (depends on 1) The system of claim 1, wherein each of the plurality of stateless network devices comprises at least one of a wireless router, a hub, a switch, a router, a cable modem, a digital subscriber line (DSL) modem, and the like. ### Claim 3 (depends on 1) The system of claim 1, wherein the over-subscription signal includes network traffic information identifying at least one network traffic flow destined for the first DPI device. ### Claim 4 (depends on 3) The system of claim 3, wherein network traffic flows have at least two priority levels and wherein the identified at least one network traffic flow comprises a low priority traffic flow. ### Claim 5 A distributed denial of service (DDoS) attack mitigation system comprising: a plurality of stateless network devices connected to a network; a plurality of Deep Packet Inspection (DPI) devices connected to one or more of the plurality of stateless network devices, each of the plurality of DPI devices configured to detect a DDoS attack and further configured to detect on over-subscription condition caused by a flow of network traffic thereto so as to generate and transmit an over-subscription signal; a software defined network (SDN) controller connected to one or more of the plurality of stateless network devices and connected to the plurality of DPI devices, the SDN controller comprising logic integrated with and/or executable by a processor, the logic being configured to: receive an over-subscription signal from a first DPI device of the one or more DPI devices; analyze the over-subscription signal received from the first DPI device; update a network traffic policy; send the updated network policy to the plurality of stateless network devices; send the updated network policy from the plurality of stateless network devices to the plurality of DPI devices, based the updated network policy: either i) redirecting at least some of network traffic destined for the first DPI device to one of the plurality of DPI devices different from the first DPI device based upon customer priority prescribed in the network traffic policy associated with network traffic to be diverted to another DPI device; or ii) dropping lower network traffic to the first DPI device based on the analyzed over-subscription signal; and send a signal indicative of the updated network policy to at least some of the plurality of stateless network devices to achieve load-bola acing of the network traffic flowing to the one or more DPI devices. ### Claim 6 (depends on 5) The system of claim 5, wherein the SDN protocol signal operates in accordance with OpenFlow. ### Claim 7 (depends on 5) The system of claim 5, wherein the logic of the SDN controller is further configured to update the network policy based on user-specified re-routing criteria. ### Claim 8 (depends on 5) The system of claim 5, wherein the SDN protocol signal reconfigures the at least some of the plurality of stateless network devices with the updated network traffic policy or other configuration information. ### Claim 9 A method for automatic handling of device group oversubscription, the method comprising steps of: receiving, by a controller, an over-subscription signal from a first DPI device of a plurality of DPI devices, wherein the controller is connected to one or more of a plurality of stateless network devices and connected to the plurality of DPI devices; analyzing, by the controller, the over-subscription signal received from the first DPI device; updating, by the controller, a network traffic policy; sending the updated network policy to the plurality of stateless network devices; sending the updated network policy from the plurality of stateless network devices to the plurality of DPI devices; based the updated network policy: either i) redirecting at least some of network traffic destined for the first DPI device to one of the plurality of DPI devices different from the first DPI device update a network traffic policy to either i) redirecting at least some of network traffic destined for the first DPI device to the one or more DPI devices different from the first DPI device based upon customer priority prescribed in the network traffic policy associated with network traffic to be diverted to another DPI device or ii) dropping lower network traffic to the first DPI device based on the analyzed over-subscription signal; or ii) dropping lower network traffic to the first DPI device based on the analyzed over-subscription signal; and sending, by the controller, a signal indicative of the updated network policy to at least some of the plurality of stateless network devices to achieve load-balancing of the network traffic flowing to the one or more DPI devices. ### Claim 10 (depends on 9) The method of claim 9, wherein each of the plurality of stateless network devices comprises at least one of a wireless router, a hub, a switch, a router, a cable modem, a digital subscriber line (DSL) modem, and the like. ### Claim 11 (depends on 9) The method of claim 9, further comprising detecting an over-subscription condition by the first DPI device prior to sending the signal to the controller. ### Claim 12 (depends on 9) The method of claim 9, wherein the over-subscription signal includes network traffic information identifying at least one network traffic flow destined for the first DPI device. ### Claim 13 (depends on 12) The method of claim 12, wherein network traffic flows have at least two priority levels and wherein the identified at least one network traffic flow comprises a low priority traffic flow. ### Claim 14 (depends on 9) The method of claim 9, wherein the controller comprises a software defined network (SDN) controller and wherein the signal comprises a SDN protocol signal. ### Claim 15 (depends on 14) The method of claim 14, wherein the SDN protocol signal operates in accordance with OpenFlow. ### Claim 16 (depends on 14) The method of claim 14, wherein the step of updating the network traffic policy further comprises updating the network policy based on user-specified re-routing criteria. ### Claim 17 (depends on 14) The method of claim 14, further comprising the step of reconfiguring, via the SDN protocol signal, at least some of the plurality of stateless network devices with the updated network traffic policy or other configuration information.