Method and system of mitigating network attacks
AssigneeCiena Corporation
InventorsDavid Jordan Krauss, Loudon Blair
Life of this patent
Estimating the term…
Abstract
Systems and methods for mitigating network attacks include, responsive to detection of malicious traffic in a network, causing creation of an isolated network slice in the network where the isolated network slice is a set of connection resources that are allocated to a flow of traffic and that spans a plurality of network devices in the network; and causing rerouting of the malicious traffic from a source node of the malicious traffic to a deceptive network resource along the isolated network slice.
Claims17
A non-transitory computer readable medium for mitigating network attacks, the non-transitory computer readable medium comprising computer readable program code for performing steps of:
- responsive to detection of malicious traffic in a network, causing creation of an isolated network slice in the network, wherein the isolated network slice is provisioned based on configurations of ports and switches in the network to provide a flow of traffic on a path through a plurality of network devices in the network, and wherein the isolated network slice provides traffic isolation through one or more of Layers 1, 2, and 3 provisioning of the ports and switches in the network;
- and
- causing rerouting of the malicious traffic from a source node of the malicious traffic to a deceptive network resource along the isolated network slice while valid traffic remains routed as is, wherein the deceptive network resource, which is created responsive to the detection of the malicious traffic in the network, appears to the source node as a valid network resource targeted by the malicious traffic, and deflects the source node away from the valid network resource.
A computing system configured as an orchestrator for mitigating network attacks, the computing system comprising:
- one or more processors and memory including computer readable program code that, when executed, causes the one or more processors to
- responsive to detection of malicious traffic in a network, cause creation of an isolated network slice in the network, wherein the isolated network slice is provisioned based on configurations of ports and switches in the network to provide a flow of traffic on a path through a plurality of network devices in the network, and wherein the isolated network slice provides traffic isolation through one or more of Layers 1, 2, and 3 provisioning of the ports and switches in the network, and
- cause rerouting of the malicious traffic from a source node of the malicious traffic to a deceptive network resource along the isolated network slice while valid traffic remains routed as is, wherein the deceptive network resource, which is created responsive to the detection of the malicious traffic in the network, appears to the source node as a valid network resource targeted by the malicious traffic, and deflects the source node away from the valid network resource.
A method comprising:
- responsive to detection of malicious traffic in a network, causing creation of an isolated network slice in the network, wherein the isolated network slice is provisioned based on configurations of ports and switches in the network to provide a flow of traffic on a path through a plurality of network devices in the network, and wherein the isolated network slice provides traffic isolation through one or more of Layers 1, 2, and 3 provisioning of the ports and switches in the network;
- and
- causing rerouting of the malicious traffic from a source node of the malicious traffic to a deceptive network resource along the isolated network slice while valid traffic remains routed as is, wherein the deceptive network resource, which is created responsive to the detection of the malicious traffic in the network, appears to the source node as a valid network resource targeted by the malicious traffic, and deflects the source node away from the valid network resource.
Dependencies are inferred from the claim text.