Systems and methods for mitigating denial of service attacks
AssigneeCenturyLink Intellectual Property LLC
InventorsDean Ballew, John R.B. Woodworth
Life of this patent
Estimating the term…
Abstract
Examples of the present disclosure are directed to systems and methods for using router identifier information to mitigate denial of service attacks in an autonomous system (AS). Each router of the AS may be assigned a router identifier (ID) that is unique to the AS and may be periodically changed. The ingress router first receiving the packet within a particular AS may insert its router ID into the packet. A threat intelligence system may sample packets of traffic received by the AS and examine the inserted ingress router IDs in making a threat determination. If a distribution of detected ingress router IDs from sampled packets does not match an expected distribution of ingress router IDs, one or more threat mitigation actions may be invoked.
Claims16
A method comprising:
- receiving traffic information for a first autonomous system, wherein the traffic information includes:
- router identifier information identifying at least one ingress router receiving traffic at the first autonomous system;
- and
- identification of a source of the traffic;
- determining whether the router identifier information matches expected ingress router information for the source of the traffic;
- and
- causing, based at least in part on determining that the router identifier information does not match the expected ingress router information for the source of the traffic, a threat mitigation action to be invoked,
- wherein determining whether the router identifier information matches the expected ingress router information further comprises:
- extracting the router identifier information from a plurality of sampled packets received by the first autonomous system;
- determining, from the router identifier information, a distribution of ingress routers for the traffic during a period of time;
- and
- determining an expected distribution of ingress routers during the period of time based on historical data.
A system comprising:
- at least one processor;
- and
- memory, operatively connected to the at least one processor and storing instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising:
- receiving traffic information for a first autonomous system, wherein the traffic information includes:
- router identifier information identifying at least one ingress router receiving traffic at the first autonomous system;
- and
- identification of a source of the traffic;
- determining whether the router identifier information matches expected ingress router information for the source of the traffic;
- and
- causing, based at least in part on determining that the router identifier information does not match the expected ingress router information for the source of the traffic, a threat mitigation action to be invoked,
- wherein determining whether the router identifier information matches the expected ingress router information further comprises:
- extracting the router identifier information from a plurality of sampled packets received by the first autonomous system;
- determining, from the router identifier information, a distribution of ingress routers for the traffic during a period of time;
- and
- determining an expected distribution of ingress routers during the period of time based on historical data.
Dependencies are inferred from the claim text.