# US 2021/0243225 A1 · Event driven route control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243225 A1 - Document ID: US20210243225A1 - Status: Published application - Kind: A1 - Application number: 17/239,745 - Filed: 2021-04-26 - Published: 2021-08-05 - Earliest claimed: 2014-09-12 - Assignees: Level 3 Communications, LLC - Applicants: Level 3 Communications, LLC - Inventors: Robert Smith; Shawn Marck; Christopher Newton - Web page: https://patentgrep.com/patent/US20210243225A1 ## CPC - H04L 63/1458: {Denial of Service} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments provide system and methods for a DDoS service using a mix of mitigation systems (also called scrubbing centers) and non-mitigation systems. The non-mitigation systems are less expensive and thus can be placed at or near a customer's network resource (e.g., a computer, cluster of computers, or entire network). Under normal conditions, traffic for a customer's resource can go through a mitigation system or a non-mitigation system. When an attack is detected, traffic that would have otherwise gone through a non-mitigation system is re-routed to a mitigation system. Thus, the non-mitigation systems can be used to reduce latency and provide more efficient access to the customer's network resource during normal conditions. Since the non-mitigation servers are not equipped to respond to an attack, the non-mitigation systems are not used during an attack, thereby still providing protection to the customer network resource using the mitigation systems. ## Claims ### Claim 1 A method comprising: detecting an attack event targeting a customer network resource; determining a routing scheme that routes network traffic to one or more mitigation systems of a mitigation network; communicating the routing scheme to one or more routing devices to cause the one or more routing devices to update from a first Domain Name Service (DNS) zone associated with a non-mitigation system of the mitigation network to a second DNS zone associated with the one or more mitigation systems; and causing the network traffic to be routed to according to the routing scheme, wherein a distributed system of devices determines the routing scheme based on signaling from a central server, and a plurality of possible routing schemes are predetermined before the attack event is detected. ### Claim 2 (depends on 1) The method as recited in claim 1, further comprising: detecting an end of the attack event; and communicating another routing scheme corresponding to the non-mitigation system to the one or more routing devices. ### Claim 3 (depends on 1) The method as recited in claim 1, further comprising: determining one or more properties of any one or more of the following: the attack event, the mitigation network, and the customer network resource, and wherein the routing scheme is selected based on the one or more determined properties. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein a central server of the mitigation network determines the routing scheme. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein the customer network resource is a customer network or a computer hosting a website of the customer. ### Claim 6 (depends on 1) The method as recited in claim 1, wherein the attack event is a distributed denial of service attack. ### Claim 7 A mitigation network comprising: at least one processor; memory, operatively connected to the at least one processor and storing instructions that, when executed by the at least one processor, cause the at least one processor to perform a method, the method comprising: detecting an attack event targeting a customer network resource; determining a routing scheme that routes network traffic to one or more mitigation systems of the mitigation network; communicating the routing scheme to one or more routing devices to cause the one or more routing devices to update from a first Domain Name Service (DNS) zone associated with a non-mitigation system of the mitigation network to a second DNS zone associated with the one or more mitigation systems; and causing the network traffic to be routed to according to the routing scheme, wherein a distributed system of devices determines the routing scheme based on signaling from a central server, and a plurality of possible routing schemes are predetermined before the attack event is detected. ### Claim 8 (depends on 7) The mitigation network as recited in claim 7, the method further comprising: detecting an end of the attack event; and communicating another routing scheme corresponding to the non-mitigation system to the one or more routing devices. ### Claim 9 (depends on 7) The mitigation network as recited in claim 7, the method further comprising: determining one or more properties of any one or more of the following: the attack event, the mitigation network, and the customer network resource, and wherein the routing scheme is selected based on the one or more determined properties. ### Claim 10 (depends on 7) The mitigation network as recited in claim 7, wherein a central server of the mitigation network determines the routing scheme. ### Claim 11 (depends on 7) The mitigation network as recited in claim 7, wherein the customer network resource is a customer network or a computer hosting a website of the customer. ### Claim 12 (depends on 7) The mitigation network as recited in claim 7, wherein the attack event is a distributed denial of service attack. ### Claim 13 Non-transitory computer readable media comprising instructions that, when executed by one or more processors associated with a mitigation network comprising one or more mitigation systems, cause the one or more processors to: detecting an attack event targeting a customer network resource; determining a routing scheme that routes network traffic to one or more mitigation systems of a mitigation network; communicating the routing scheme to one or more routing devices to cause the one or more routing devices to update from a first Domain Name Service (DNS) zone associated with a non-mitigation system of the mitigation network to a second DNS zone associated with the one or more mitigation systems; and causing the network traffic to be routed to according to the routing scheme, wherein a distributed system of devices determines the routing scheme based on signaling from a central server, and a plurality of possible routing schemes are predetermined before the attack event is detected. ### Claim 14 (depends on 13) The non-transitory computer readable media as recited in claim 13, wherein the instructions further cause the one or more processors to: detect an end of the attack event; and communicate another routing scheme corresponding to the non-mitigation system to the one or more routing devices. ### Claim 15 (depends on 13) The non-transitory computer readable media as recited in claim 13, wherein the instructions further cause the one or more processors to: determine one or more properties of any one or more of the following: the attack event, the mitigation network, and the customer network resource, wherein the routing scheme is selected based on the one or more determined properties.