# US 2019/0173901 A1 · Traffic attack protection method and system, controller, router, and storage medium

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173901 A1
- Document ID: US20190173901A1
- Status: Published application
- Kind: A1
- Application number: 16/250,438
- Filed: 2019-01-17
- Published: 2019-06-06
- Earliest claimed: 2016-10-31
- Assignees: Tencent Technology (Shenzhen) Company Limited
- Applicants: Tencent Technology (Shenzhen) Company Limited
- Inventors: Penghui MI; Sujian LU
- Web page: https://patentgrep.com/patent/US20190173901A1

## CPC

- H04L 45/04: {Interdomain routing, e.g. hierarchical routing}
- H04L 41/142: using statistical or mathematical methods
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 43/106: using time related information in packets, e.g. by adding timestamps
- H04L 45/02: Topology update or discovery
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/1458: {Denial of Service}
- H04L 45/036: Updating the topology between route computation elements, e.g. between OpenFlow controllers
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for protection against cyberattack includes: establishing neighbor relationships with border routers at a plurality of traffic entrances; and receiving an attack protection request from an intrusion detection system at a first traffic entrance. The first traffic entrance is any one of the plurality of traffic entrances. The attack protection request carries a target network address that has been attacked. The method also includes: generating routing information based on the attack protection request, and sending the routing information to a first border router based on the neighbor relationships. The routing information includes the target network address and routing address information. The first border router performs, based on the routing address information, protection processing on traffic that corresponds to the target network address. The first border router is a border router at the first traffic entrance at which the intrusion detection system that sends the attack protection request is located.

## Claims

### Claim 1

A method for protection against cyberattack, comprising:
establishing, by a controller, neighbor relationships with border routers at a plurality of traffic entrances;
receiving, by the controller, an attack protection request sent by an intrusion detection system at a first traffic entrance, the first traffic entrance being any one of the plurality of traffic entrances, and the attack protection request carrying a target network address that has been attacked;
generating, by the controller, routing information based on the attack protection request, the routing information comprising the target network address and routing address information; and
sending, by the controller, the routing information to a first border router based on the neighbor relationships, so that the first border router performs, based on the routing address information, protection processing on traffic that corresponds to the target network address, the first border router being a border router at the first traffic entrance at which the intrusion detection system that sends the attack protection request is located.

### Claim 2 (depends on 1)

The method according to claim 1, wherein generating the routing information based on the attack protection request comprises:
parsing the attack protection request to obtain the target network address;
setting a next-hop address that corresponds to the target network address; and
generating the routing information based on the target network address and the next-hop address, the routing information comprising the target network address and the next-hop address.

### Claim 3 (depends on 2)

The method according to claim 2, wherein the attack protection request comprises a traffic filtering request, and
setting the next-hop address comprises: setting the next-hop address as pointing to a first traffic attack processing system.

### Claim 4 (depends on 3)

The method according to claim 3, further comprising:
diverting, by the first border router based on the routing information, the traffic that corresponds to the target network address to the first traffic attack processing system, so that the first traffic attack processing system filters the traffic that corresponds to the target network address; and
receiving, by the first border router, traffic that is filtered and returned by the first traffic attack processing system.

### Claim 5 (depends on 2)

The method according to claim 2, wherein the attack protection request comprises a traffic blocking request, and
setting the next-hop address comprises: setting the next-hop address as pointing to a null interface.

### Claim 6 (depends on 5)

The method according to claim 5, further comprising:
sending, by the first border router based on the routing information, the traffic that corresponds to the target network address to the null interface.

### Claim 7 (depends on 1)

The method according to claim 1, wherein the routing information further comprises a preference that corresponds to the routing information; and
after the controller receives the routing information and before the first border performs the protection processing, the method further comprises:
setting the preference that corresponds to the routing information as being higher than a local preference of the first border router, so that the first border router performs, based on the routing information, the protection processing on the traffic that corresponds to the target network address.

### Claim 8 (depends on 1)

The method according to claim 1, wherein:
the controller is a controller group comprising at least a first controller and a second controller;
each attack protection request sent from the intrusion detection system and received by the controller group further comprises a time stamp; and
the method further comprises:
when one of the first controller and the second controller is offline, maintaining, by the other one of the first controller and the second controller, services of: receiving the attack protection request, generating the routing information, and sending the routing information to the first boarder router; and
when the first controller and the second controller are both online, synchronizing routing delivery records between the first controller and the second controller.

### Claim 9 (depends on 8)

The method according to claim 8, wherein synchronizing the routing delivery records comprises:
receiving, by one of the first controller and the second controller, a time stamp that is most recently recorded by the other one of the first controller and the second controller;
comparing the received time stamp with a newest local time stamp;
if the received time stamp is later than the newest local time stamp, obtaining, from the other one of the first controller and the second controller, the routing delivery records during a period from the newest local stamp to the received time stamp; and
if the received time stamp is not later than the newest local time stamp, determining that a local record is the newest.

### Claim 10

A controller, comprising:
one or more memories; and
one or more processors,
wherein the one or more processors are configured to:
establish neighbor relationships with border routers at a plurality of traffic entrances;
receive an attack protection request sent by an intrusion detection system a first traffic entrance, the first traffic entrance being at any one of the plurality of traffic entrances, and the attack protection request carrying a target network address that has been attacked;
generate routing information based on the attack protection request, the routing information comprising the target network address and routing address information; and
send the routing information to a first border router based on the neighbor relationship, so that the first border router performs, based on the routing address information, protection processing on traffic that corresponds to the target network address, the first border router being a border router at the first traffic entrance at which the intrusion detection system that sends the attack protection request is located.

### Claim 11 (depends on 10)

The controller according to claim 10, wherein the one or more processors are further configured to:
parse the attack protection request to obtain the target network address;
set a next-hop address that corresponds to the target network address; and
generate the routing information based on the target network address and the next-hop address, the routing information comprising the target network address and the next-hop address.

### Claim 12 (depends on 11)

The controller according to claim 11, wherein the one or more processors are further configured to:
set the next-hop address that corresponds to the target network address based on the parsed attack protection request.

### Claim 13 (depends on 12)

The controller according to claim 12, wherein:
the attack protection request comprises a traffic filtering request, and
the one or more processors are further configured to: set the next-hop address as pointing to a first traffic attack processing system.

### Claim 14 (depends on 12)

The controller according to claim 12, wherein:
the attack protection request comprises a traffic blocking request, and
the one or more processors are further configured to: set the next-hop address as pointing to a null interface.

### Claim 15 (depends on 10)

The controller according to claim 10, wherein:
the controller is a controller group comprising at least a first controller and a second controller;
each attack protection request sent from the intrusion detection system and received by the controller group further comprises a time stamp;
when one of the first controller and the second controller is offline, the other one of the first controller and the second controller is configured to maintain services of: receiving the attack protection request, generating the routing information, and sending the routing information to the first boarder router; and
when the first controller and the second controller are both online, the first controller and the second controller are configured to synchronize routing delivery records between the first controller and the second controller.

### Claim 16 (depends on 15)

The controller according to claim 15, wherein when synchronizing the routing delivery records, one of the first controller and the second controller are further configured to:
receive a time stamp that is most recently recorded by the other one of the first controller and the second controller;
compare the received time stamp with a newest local time stamp;
if the received time stamp is later than the newest local time stamp, obtain, from the other one of the first controller and the second controller, the routing delivery records during a period from the newest local stamp to the received time stamp; and
if the received time stamp is not later than the newest local time stamp, determine that a local record is the newest.

### Claim 17

A border router, comprising:
one or more memories; and
one or more processors,
wherein the one or more processors are configured to:
establish a neighbor relationship with a controller, the controller having neighbor relationships with a plurality of the border routers at a plurality of traffic entrances;
receive, based on the neighbor relationship, routing information that is sent by the controller, the routing information comprising routing address information and a target network address that has been attacked; and
perform, based on the routing information, protection processing on the traffic that corresponds to the target network address.

### Claim 18 (depends on 17)

The border router according to claim 17, wherein:
the routing address information comprises a next-hop address that corresponds to the target network address; and
the one or more processors are further configured to: send the traffic that corresponds to the target network address to the next-hop address.

### Claim 19 (depends on 18)

The border router according to claim 18, wherein:
the next-hop address points to a traffic attack processing system; and
the one or more processors are further configured to:
divert, based on the routing information, the traffic that corresponds to the target network address to the traffic attack processing system, so that the traffic attack processing system filters the traffic that corresponds to the target network address; and
receive traffic that is filtered and returned by the traffic attack processing system.

### Claim 20 (depends on 18)

The border router according to claim 18, wherein:
the next-hop address points to a null interface; and
the one or more processors are further configured to: send, based on the routing information, the traffic that corresponds to the target network address to the null interface.