US 12,684,013 B1 · Mitigating denial of service attacks by leveraging geographical locations of network edges

Abstract

A system analyzes network traffic at the network edge in a Point-of-Presence (POP) to prevent denial of service attacks, such a reflection attack, and filters such attack traffic. The POP can analyze a source identifier of the network traffic, such as a source prefix, and compare the source identifier to known source identifiers from the same geographic region as the POP. If the source identifier is outside of the POPs geographic region, then the network traffic is rate limited, such as by blocking the network traffic or reducing the network traffic to a desired threshold. To further ensure that the traffic is routed to the appropriate POP, the POP edge location announces anycast addresses for receiving the network traffic. The geographic region can be defined as a city, a country, sub-regions within a country, a portion of a continent (e.g., southeast region of Asia), a continent, etc.

Claims20

Dependent claims

A method of identifying and mitigating a distributed denial of service (DDoS) attack, the method comprising:

receiving a list of acceptable source prefixes of content providers in a Point-of-Presence (POP) edge location of a network, wherein the acceptable source prefixes are based upon a history of source prefixes being received within a same geographic region as the POP edge location;
storing the list of the acceptable source prefixes, of content providers, at the POP edge location for analysis of network traffic propagating through the POP edge location;
receiving network traffic with a source prefix of a content provider for forwarding to a destination server computer through a networking service;
comparing the source prefix to the list of acceptable source prefixes;
if the source prefix is not on the list of acceptable source prefixes, which are associated with the same geographic region as the POP edge location, rate limiting the network traffic from accessing the networking service;
and
if the source prefix is on the list of acceptable source prefixes, transmitting the network traffic to the networking service without rate limiting for forwarding to the destination server computer.

4 more elements

Dependencies are inferred from the claim text.

Mitigating denial of service attacks by leveraging geographical locations of network edges

Life of this patent

Mitigating denial of service attacks by leveraging geographical locations of network edges

Life of this patent

Abstract

Claims20