Discriminating defense against DDoS attacks

A system for defending a server against distributed denial-of-service (DDoS) attacks, the system comprising:

• a processor;
• and
• a memory with computer code instructions stored thereon, the processor and the memory, with the computer code instructions, being configured to cause the system to:
• obtain an indication of packets defined as important by a defending server;
• define a discrimination criterion, the discrimination criterion being a mechanism to identify packets complying with the obtained indication;
• obtain packets;
• and
• for each obtained packet, control transmission of the packet to the defending server based on a verification, using the discrimination criterion, that the packet complies with the obtained indication, thereby defending the server from DDoS attacks;
• wherein control transmission of the packet to the defending server comprises:
• at a guarding node associated with the defending server, modify or maintain a pass field of the packet to indicate compliance or non-compliance with the obtained indication;
• and
• transmit the packet to the defending server in response to the pass field of the packet indicating compliance with the obtained indication;
• or carry out a policy of dropping the packet, at a router, in response to the pass field of the packet indicating non-compliance with the obtained indication.

A computer program product for defending a server against distributed denial-of-service (DDoS) attacks, the computer program product comprising:

• a non-transitory computer-readable medium having computer-readable program instructions stored thereon, the instructions, when executed by a processor, causing the processor to:
• obtain an indication of packets defined as important by a defending server;
• define a discrimination criterion, the discrimination criterion being a mechanism to identify packets complying with the obtained indication;
• obtain packets;
• and
• for each obtained packet, control transmission of the packet to the defending server based on a verification, using the discrimination criterion, that the packet complies with the obtained indication, thereby defending the server from DDoS attacks;
• wherein control transmission of the packet to the defending server comprises:
• at a guarding node associated with the defending server, modify or maintain a pass field of the packet to indicate compliance or non-compliance with the obtained indication;
• and
• transmit the packet to the defending server in response to the pass field of the packet indicating compliance with the obtained indication;
• or carry out a policy of dropping the packet, at a router, in response to the pass field of the packet indicating non-compliance with the obtained indication.