Detecting malicious packets in edge network devices

A network edge router apparatus for detecting a Denial of Service (DoS) attack in a network, comprising:

• a memory, coupled to the edge router, configured to store instructions;
• a processor, coupled to the edge router, disposed in communication with the memory, wherein said processor upon execution of the instructions is configured to:
• receive and store in the memory DoS attack traffic information from a coupled network management system;
• receive network traffic;
• determine if at least a portion of the received network traffic matches at least a portion of the stored DoS attack information;
• determine an alert condition exists if at least a portion of the received network traffic is determined to match at least a portion of the stored DoS attack information;
• send an alert signal if it is determined an alert condition exists to an attack mitigation device coupled in the network causing the attack mitigation device to transition to a mitigation state for mitigating effects of a DoS attack upon the network.

A computer method for detecting a Denial of Service (DoS) attack in a network by a network edge router device whereby network traffic flows from the edge router to a core router in the network, comprising the steps:

• storing DoS attack traffic information in storage associated with the edge router;
• receiving network traffic in the edge router;
• determining in the edge router if a portion of the received network traffic matches at least a portion of the stored DoS attack information;
• determining in the edge router an alert condition exists if a portion of the received network traffic is determined to match at least a portion of the stored DoS attack information;
• incrementing a counter in the edge router associated with the portion of the received network traffic determined to match at least a portion of the stored DoS attack information;
• determining if the counter exceeds a predetermined threshold value when incremented within a prescribed period of time;
• applying a traffic policer in the edge router device when it is determined the counter exceeds a predetermined threshold value when incremented within the prescribed period of time;
• determining if a traffic rate for the received traffic exceeds a predetermined threshold rate in the traffic policer;
• transmitting the alert signal to the attack mitigation device when the counter exceeds a predetermined threshold value when incremented within the prescribed period of time and it is determined the traffic rate for the received traffic exceeds a predetermined threshold rate.