US 10,855,719 B2 · Automated DDOS attack mitigation via BGP messaging

Abstract

Various embodiments of the invention disclosed herein provide techniques for mitigating a distributed denial of service (DDoS) attack on a targeted computer system. A border gateway protocol (BGP) controller receives, via a first router, a BGP message that includes an indicator indicating that a computer system associated with the first router is under a DDoS attack. In response to receiving the BGP message, the BGP controller, in performs one or more operations to mitigate the DDoS attack. As a result, the time between detection of a DDoS attack and mitigating the attack is reduced relative to prior approaches. After receiving the BGP message indicating a DDoS attack is in progress, the DDoS attack mitigation platform automatically takes steps to mitigate the DDoS attack without further manual intervention. Consequently, the targeted computer system recovers more quickly and begins to respond to legitimate network requests sooner relative to prior approaches.

Claims18

Dependent claims

A computer-implemented method for mitigating a distributed denial of service (DDoS) attack on a targeted computer system, the method comprising:

receiving, via a first router during a border gateway protocol (BGP) session, a first BGP message that includes a first indicator indicating that a first computer system associated with the first router is under a DDoS attack;
in response to receiving the first BGP message, automatically, via a second router coupled to a second computer system, advertising a first route for routing network traffic directed to the first computer system to the second router, wherein a first number of IP addresses specified by the first route is determined based on a second number of IP addresses specified by a second route for routing network traffic directed to the first computer system, wherein the first number is greater than the second number;
receiving, subsequent to the first route being advertised and via the second router, first network traffic directed to the first computer system;
determining that at least a portion of the first network traffic is legitimate;
and
transmitting the at least a portion of the first network traffic to the first computing system via the first router.

3 more elements

A non-transitory computer-readable storage medium including instructions that, when executed by a processor, cause the processor to mitigate a distributed denial of service (DDoS) attack on a targeted computer system, by performing the steps of:

receiving, via a first router during a border gateway protocol (BGP) session, a first BGP message that includes a first indicator indicating that a first computer system associated with the first router is under a DDoS attack;
in response to receiving the first BGP message, automatically, via a second router coupled to a second computer system, advertising a first route for routing network traffic directed to the first computer system to the second router, wherein a first number of IP addresses specified by the first route is determined based on a second number of IP addresses specified by a second route for routing network traffic directed to the first computer system, wherein the first number is greater than the second number;
receiving, subsequent to the first route being advertised and via the second router, first network traffic directed to the first computer system;
determining that at least a portion of the first network traffic is legitimate;
and
transmitting the at least a portion of the first network traffic to the first computing system via the first router.

3 more elements

A computing device, comprising:

a memory that includes a distributed denial of service (DDoS) mitigation application;
and
a processor that is coupled to the memory and, when executing the DDoS mitigation application, is configured to:
receive, via a first router during a border gateway protocol (BGP) session, a first BGP message that includes a first indicator indicating that a first computer system associated with the first router is under a DDoS attack;
in response to receiving the first BGP message, automatically, via a second router coupled to a second computer system, advertise a first route for routing network traffic directed to the first computer system to the second router, wherein a first number of IP addresses specified by the first route is determined based on a second number of IP addresses specified by a second route for routing network traffic directed to the first computer system, wherein the first number is greater than the second number;
receive, subsequent to the first route being advertised and via the second router, first network traffic directed to the first computer system;
determine that at least a portion of the first network traffic is legitimate;
and
transmit the at least a portion of the first network traffic to the first computing system via the first router.

6 more elements

Dependencies are inferred from the claim text.

Automated DDOS attack mitigation via BGP messaging

Life of this patent

Automated DDOS attack mitigation via BGP messaging

Life of this patent

Abstract

Claims18