US 2019/0245887 A1 · NETWORK PROTOCOL MODIFICATION SYSTEMS FOR MITIGATING ATTACKS

Abstract

In a particular embodiment, a network protocol modification system is configured to identify a malicious attack on a particular computing system, and modify a protocol (e.g., Border Gateway Protocol) that dictates a path of network traffic to the particular computing system. The system may, for example, modify a protocol (e.g., Border Gateway Protocol) that dictates the path of network traffic to the particular computing system for: (1) all network traffic; (2) any network traffic from one or more particular sources; and/or (3) any other suitable combination of traffic. In some embodiments, the system may interface with one or more ISP or other systems in order to propagate network protocol updates. In particular embodiments, the system is particularly configured to mitigate one or more DDoS attacks against a particular target network or service.

Claims20

Dependent claims

A network protocol modification system comprising one or more computing devices implementing a network-based attack mitigation service, each of the one or more computing devices comprising at least one computer processor and memory, wherein the network protocol modification system is configured for:

monitoring network traffic at a target server;
detecting, based at least in part on the network traffic, a network attack on the particular target server, wherein the network attack is directed to a combination of network addresses utilized by the target server;
identifying one or more sources of the network attack, the one or more sources having one or more source network addresses;
and
modifying routing of network transmissions from the one or more sources to the target server by:
generating at least one network protocol modification packet based at least in part on the network attack;
and
transmitting the at least one network protocol modification packet to at least one router in communication with at least one of the one or more computing devices.

5 more elements

A computer-implemented network routing protocol modification method comprising:

detecting, by a network protocol modification system comprising one or more processors, a network attack on one or more computing devices, the network attack being directed to a combination of network addresses utilized by the one or more computing devices;
identifying, by a network protocol modification system comprising one or more processors, based at least in part on the network attack, one or more source network addresses that are a source of the network attack;
providing, by one or more processors, a networked communications link between the network protocol modification system and an Internet Service Provider (ISP) system, the ISP system comprising an autonomous system (AS) comprising at least one node;
and
mitigating the network attack, by a network protocol modification system comprising one or more processors, by:
generating a BGP packet configured to modify how data addressed to the combination of network addresses is routed, the BGP packet defining routing instructions for malicious network traffic originating from the one or more source network addresses and having a destination address of one of the combination of network addresses utilized by the one or more computing devices;
and
transmitting the BGP packet to the autonomous system (AS) via the networked communications link, wherein
the routing instructions comprise an instruction to drop the malicious network traffic.

6 more elements

A network protocol modification system comprising one or more computing devices implementing a network-based network routing protocol modification service, each of the one or more computing devices comprising at least one computer processor and memory, wherein the network protocol modification system is configured for:

identifying one or more sources of unwanted network traffic, the one or more sources having one or more source network addresses;
providing a networked communications link between the network protocol modification system and an Internet Service Provider (ISP) system, the ISP system comprising an autonomous system (AS) comprising at least one node;
and
modifying routing of network transmissions from the one or more source network addresses to one or more destination network addresses by:
generating at least one network protocol modification packet based at least in part on the unwanted network traffic, the at least one network protocol modification packet defining routing instructions for the unwanted traffic between the one or more source network addresses and the one or more destination network addresses;
and
transmitting the at least one network protocol modification packet to the AS via the networked communications link for configuration of the at least one node, wherein:
the routing instructions comprise an instruction to drop the unwanted traffic.

5 more elements

Dependencies are inferred from the claim text.

Network protocol modification systems for mitigating attacks

Life of this patent

Network protocol modification systems for mitigating attacks

Life of this patent

Abstract

Claims20