METHODS AND SYSTEMS FOR DETECTING AND MITIGATING A HIGH-RATE DISTRIBUTED DENIAL OF SERVICE (DDoS) ATTACK

A method performed by a flow-based system for detecting traffic anomaly at various nodes within a network, comprising:

• based on a monitoring of a plurality of flows traversing through the flow-based system, generating a plurality of flow state records corresponding to the plurality of flows, wherein an individual flow of the plurality of flows is a stream of packets having a same protocol, wherein an individual flow state record of the plurality of flow state records includes flow state information associated with the individual flow;
• generate a plurality of aggregate records based on cumulative statistics associated with the plurality of flow state records;
• computing a net probability of attack based on an analysis of the plurality of aggregate records to detect the traffic anomaly;
• and
• in an event the net probability of attack is greater than a net probability threshold, initiating a mitigation action for mitigating the traffic anomaly.

A system, comprising:

• a processor;
• a memory operatively coupled to the processor;
• a packet processing module operatively coupled to the processor and the memory, and configured to:
• based on a monitoring of a plurality of flows traveling through a network, generate a plurality of flow state records corresponding to the plurality of flows, wherein an individual flow of the plurality of flows is a stream of packets having a same protocol, wherein an individual flow state record of the plurality of flow state records includes flow state information associated with the individual flow;
• and
• generate a plurality of aggregate records based on cumulative statistics associated with the plurality of flow state records;
• a bulk statistics record (BSR) module operatively coupled to the processor and the memory, and configured to:
• compute a net probability of attack based on an analysis of the plurality of aggregate records to detect traffic anomaly associated with the network;
• and
• in an event the net probability of attack is greater than a net probability threshold, initiating a mitigation action for mitigating the traffic anomaly.

A non-transitory computer readable medium including instructions for executing a process, the instructions comprising:

• instructions for, based on a monitoring of a plurality of flows traversing through a network, generating a plurality of flow state records corresponding to the plurality of flows, wherein an individual flow of the plurality of flows is a stream of packets having a same protocol, wherein an individual flow state record of the plurality of flow state records includes flow state information associated with the individual flow;
• instructions for generating a plurality of aggregate records based on cumulative statistics associated with the plurality of flow state records;
• instructions for analyzing the plurality of aggregate records to detect a traffic anomaly associated with the network;
• and
• instructions for, in an event the traffic anomaly is detected,
• identifying, within the network, a candidate node having the traffic anomaly based on a particular aggregate record associated with the candidate node, the particular aggregate record exhibiting the net probability of attack being greater than the net probability threshold;
• identifying a list of source addresses (SAs) sending traffic to the candidate node;
• and
• applying the mitigation action to a subset of flows, of the plurality of flows, that are associated with the list of SAs, wherein the mitigation action is applied to all packets of each individual flow of the subset of flows.