Distributed Denial-of-Service Attack Detection Based on Shared Network Flow Information

A data processing system for detecting distributed denial-of-service (DDoS) attacks, the data processing system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• analyze current aggregated flow information for a defined period of time;
• determine whether network flow increased above a defined flow threshold value to a second data processing system connected to a network within the defined period of time based on analyzing the current aggregated flow information;
• determine that the second data processing system is under a DDoS attack in response to determining that the network flow has increased above the defined flow threshold value to the second data processing system connected to the network within the defined period of time;
• monitoring, by the first data processing system, current local network flow information corresponding to data packets received by the first data processing system via the network;
• generating, by the first data processing system, a current local network flow information message containing the current local network flow information;
• computing, by the first data processing system, a hash value of the current local network flow information message;
• and
• broadcasting, by the first data processing system, the current local network flow information message to a plurality of randomly selected data processing systems connected to the network based on the hash value of the current local network flow information message.

A computer program product for detecting distributed denial-of-service (DDoS) attacks, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a first data processing system to cause the first data processing system to perform a method comprising:

• analyzing, by the first data processing system, current aggregated flow information for a defined period of time;
• determining, by the first data processing system, whether network flow increased above a defined flow threshold value to a second data processing system connected to a network within the defined period of time based on the analyzing of the current aggregated flow information;
• responsive to the first data processing system determining that the network flow has increased above the defined flow threshold value to the second data processing system connected to the network within the defined period of time, determining, by the first data processing system, that the second data processing system is under a DDoS attack;
• monitoring, by the first data processing system, current local network flow information corresponding to data packets received by the first data processing system via the network;
• generating, by the first data processing system, a current local network flow information message containing the current local network flow information;
• computing, by the first data processing system, a hash value of the current local network flow information message;
• and
• broadcasting, by the first data processing system, the current local network flow information message to a plurality of randomly selected data processing systems connected to the network based on the hash value of the current local network flow information message.

A data processing system for detecting distributed denial-of-service (DDoS) attacks, the data processing system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• analyze current aggregated flow information for a defined period of time, wherein the current aggregated flow information is a real-time current snapshot of an amount of network data packets flowing to the second data processing system from a plurality of different data processing systems via the network for the defined period of time;
• determine whether network flow increased above a defined flow threshold value to a second data processing system connected to a network within the defined period of time based on analyzing the current aggregated flow information;
• determine that the second data processing system is under a DDoS attack in response to determining that the network flow has increased above the defined flow threshold value to the second data processing system connected to the network within the defined period of time and transmitting a notification to the second data processing system indicating that the second data processing system is under a DDoS attack;
• determining, by the first data processing system, whether the network flow increased above the defined flow threshold value to the first data processing system, itself, within the defined period of time based on the analyzing of the current aggregated flow information;
• responsive to the first data processing system determining that the network flow has increased above the defined flow threshold value to the first data processing system, itself, within the defined period of time, determining, by the first data processing system, that the first data processing system is under the DDoS attack;
• and
• performing, by the first data processing system, mitigation steps to halt the DDoS attack on the first data processing system.

A computer program product for detecting distributed denial-of-service (DDoS) attacks, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a first data processing system to cause the first data processing system to perform a method comprising:

• analyzing, by the first data processing system, current aggregated flow information for a defined period of time, wherein the current aggregated flow information is a real-time current snapshot of an amount of network data packets flowing to the second data processing system from a plurality of different data processing systems via the network for the defined period of time;
• determining, by the first data processing system, whether network flow increased above a defined flow threshold value to a second data processing system connected to a network within the defined period of time based on the analyzing of the current aggregated flow information;
• responsive to the first data processing system determining that the network flow has increased above the defined flow threshold value to the second data processing system connected to the network within the defined period of time, determining, by the first data processing system, that the second data processing system is under a DDoS attack and transmitting a notification to the second data processing system indicating that the second data processing system is under a DDoS attack;
• determining, by the first data processing system, whether the network flow increased above the defined flow threshold value to the first data processing system, itself, within the defined period of time based on the analyzing of the current aggregated flow information;
• responsive to the first data processing system determining that the network flow has increased above the defined flow threshold value to the first data processing system, itself, within the defined period of time, determining, by the first data processing system, that the first data processing system is under the DDoS attack;
• and
• performing, by the first data processing system, mitigation steps to halt the DDoS attack on the first data processing system.