Systems and methods for detecting and remediating DDoS attacks based on energy consumption
AssigneeVerizon Patent and Licensing Inc.
InventorsPeretz Feder, Egemen K. Çetinkaya, Yousif Targali
Life of this patent
Estimating the term…
Abstract
Systems and methods described herein detect user equipment (UE)-based denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks based on energy consumption levels. An energy consumption (EC) DDoS monitoring service, collects, from one or more network devices in a core network, energy consumption data and identifies, based on the energy consumption data, normal energy consumption levels of one or more UE devices or network functions. The EC DDoS monitoring service determines, based on the normal energy consumption levels, energy consumption thresholds indicative of a DoS or DDoS attack.
Claims20
A method comprising:
- collecting, by a first network device and from one or more second network devices in a core network, energy consumption data;
- identifying, by the first network device and based on the energy consumption data, normal energy consumption levels of one or more user equipment (UE) devices and one or more network functions;
- determining, by the first network device and based on the normal energy consumption levels, energy consumption thresholds indicative of a denial-of-service (DoS) or distributed denial-of-service (DDoS) attack, wherein the energy consumption thresholds include a UE energy consumption threshold, a quality of service (QoS) flow energy consumption threshold, and a network slice energy consumption threshold;
- monitoring, by the first network device, updated energy consumption data against the energy consumption thresholds to detect a DoS or DDoS attack;
- and
- sending, by the first network device, a DoS or DDoS attack notice when the monitoring of the updated energy consumption data indicates one or more of the energy consumption thresholds have been exceeded.
A system, comprising:
- one or more first network devices configured to:
- collect, from one or more second network devices in a core network, energy consumption data;
- identify, based on the energy consumption data, normal energy consumption levels of user equipment (UE) devices and one or more network functions;
- determine, based on the normal energy consumption levels, energy consumption thresholds indicative of a denial-of-service (DoS) or distributed denial-of-service (DDoS) attack, wherein the energy consumption thresholds include a UE energy consumption threshold, a quality of service (QoS) flow energy consumption threshold, and a network slice energy consumption threshold;
- monitor updated energy consumption data against the energy consumption thresholds to detect a DoS or DDoS attack;
- and
- send a DoS or DDoS attack notice when the monitoring of the updated energy consumption data indicates one or more of the energy consumption thresholds have been exceeded.
A non-transitory, computer-readable storage media storing instructions, which, when executed by one or more processors of a first network device, cause the network device to:
- collect, from one or more second network devices in a core network, energy consumption data;
- identify, based on the energy consumption data, normal energy consumption levels of user equipment (UE) devices and one or more network functions;
- determine, based on the normal energy consumption levels, energy consumption thresholds indicative of a denial-of-service (DoS) or distributed denial-of-service (DDoS) attack, wherein the energy consumption thresholds include a UE energy consumption threshold, a quality of service (QoS) flow energy consumption threshold, and a network slice energy consumption threshold;
- monitor updated energy consumption data against the energy consumption thresholds to detect a DoS or DDoS attack;
- and
- send a DoS or DDoS attack notice when the monitoring of the updated energy consumption data indicates one or more of the energy consumption thresholds have been exceeded.
Dependencies are inferred from the claim text.