US 11,888,878 B2 · Network security

Abstract

Various example embodiments relate generally to providing security for a communication network based on detection and mitigation of an attack in the communication network. Various example embodiments supporting attack detection and mitigation may be configured to support detection and mitigation of an attack in a communication network based on distributed collection of network traffic information at network elements and analysis of aggregated network traffic information at a network controller for determining whether a traffic anomaly indicative of an attack on the communication network is detected. Various example embodiments supporting attack detection and mitigation may be configured to support detection and mitigation of an attack in a communication network based on use of traffic records for supporting the collection, aggregation, and analysis of network traffic information.

Claims18

Dependent claims

A communication network edge device (“edge device”) comprising:

at least one processor;
and
at least one memory including computer program code;
wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the edge device to at least:
monitor traffic of a communication network, for request packets and response packets;
generate a first traffic record indicative of respective measures of the request packets exiting the communication network via the edge device for respective data flows and a second traffic record indicative of respective measures of the response packets entering the communication network via the edge device for respective data flows;
and
send the first traffic record and the second traffic record from the edge device toward a controller,
wherein the first traffic record comprises a first reversible sketch and the second traffic record comprises a second reversible sketch.

6 more elements

A communications controller (“controller”) comprising:

at least one processor;
and
at least one memory including computer program code;
wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the controller to at least:
receive, from each communication network edge device in a set of communication network edge devices (‘edge devices’), a respective set of network traffic information comprising a first traffic record indicative of respective measures of request packets exiting the communication network via the respective edge device for respective data flows and a second traffic record indicative of respective measures of response packets entering the communication network via the respective edge device for respective data flows, wherein the first traffic record comprises a first reversible sketch and the second traffic record comprises a second reversible sketch;
and
determine, based on the sets of network traffic information of the edge devices, whether a traffic anomaly indicative of an attack on the communication network is detected.

4 more elements

Dependencies are inferred from the claim text.

Network security

Life of this patent

Network security

Life of this patent

Abstract

Claims18