Back-tracing ddos attacks

A method, comprising:

• monitoring, by one or more processing circuits, network traffic across a network provided by a first autonomous system, the network traffic comprising communication messages of communication sessions between a plurality of computing devices via a network device of the first autonomous system;
• detecting, by the one or more processing circuits, based on at least a portion of the network traffic, an attack on an Internet Protocol (IP) address of the network, the attack facilitated by transmission of one or more data packets across the network to a computing device of the plurality of computing devices;
• prompting, by the one or more processing circuits, responsive to detection of the attack, the network device for one or more flow records that list (i) the IP address of the network as a destination IP address and (ii) the first autonomous system as a destination autonomous system;
• generating, by the one or more processing circuits, for inclusion in a graph, a first node that comprises at least one of (i) the IP address of the network within the graph or (ii) an identification of the first autonomous system within the graph;
• identifying, by the one or more processing circuits, using at least one flow record of the one or more flow records, one or more second autonomous systems that forwarded the one or more data packets to the first autonomous system, wherein the at least one flow record lists the first autonomous system as a next hop autonomous system;
• generating, by the one or more processing circuits, responsive to identifying the one or more second autonomous systems, one or more second nodes representative of the one or more second autonomous systems within the graph;
• connecting, by the one or more processing circuits, using one or more edges of the graph, the first node to the one or more second nodes, wherein the one or more edges indicate that the one or more second autonomous systems forwarded the one or more data packets to the first autonomous system;
• and
• responsive to determining a source autonomous system of the attack using the one or more edges of the graph, storing, by the one or more processing circuits, an association between the attack and an identifier of the source autonomous system.

One or more non-transitory storage medium storing one or more instructions thereon that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• monitoring network traffic across a network provided by a first autonomous system, the network traffic comprising communication messages of communication sessions between a plurality of computing devices via a network device of the first autonomous system;
• detecting, based on at least a portion of the network traffic, an attack on an Internet Protocol (IP) address of the network, the attack facilitated by transmission of one or more data packets across the network to a computing device of the plurality of computing devices;
• prompting, responsive to detecting the attack, the network device for one or more flow records that list (i) the IP address of the network as a destination IP address and (ii) the first autonomous system as a destination autonomous system;
• generating, for inclusion in a graph, a first node that comprises at least one of (i) the IP address of the network within the graph or (ii) an identification of the first autonomous system within the graph;
• identifying, using at least one flow record of the one or more flow records, one or more second autonomous systems that forwarded the one or more data packets to the first autonomous system, wherein the at least one flow record lists the first autonomous system as a next hop autonomous system;
• generating, responsive to identifying the one or more second autonomous systems, one or more second nodes representative of the one or more second autonomous systems within the graph;
• connecting, using one or more edges of the graph, the first node to the one or more second nodes, wherein the one or more edges indicate that the one or more second autonomous systems forwarded the one or more data packets to the first autonomous system;
• and
• responsive to determining a source autonomous system of the attack using the one or more edges of the graph, storing an association between the attack and an identifier of the source autonomous system.