Architecture, systems and methods to detect efficiently DoS and DDoS attacks for large scale internet
AssigneeNarus, Inc.
InventorAntonio Nucci
Life of this patent
Estimating the term…
Abstract
The present invention efficiently detects various DDoS attacks for large scale Internet with the temporal correlation of traffic flows on the two directions of a single link, the spatial correlation of DDoS attack traffic at different locations and powerful machine learning algorithms. With these techniques, the present invention effectively detects and identifies attack sources without modifying existing IP forwarding mechanisms and without a global upgrade to Internet backbone routers. More importantly, the present invention can detect synchronized DDoS attacks even if the volume of attack traffic is extremely small at the location that is close to the attack source.
Claims16
A method for detecting a denial of service attack to a networked device comprising:
- using each of a plurality of traffic monitors, monitoring a corresponding plurality of network data instances flowing across a corresponding data connection to generate a corresponding plurality of inbound and outbound keys each extracted from a unidirectional portion of the corresponding plurality of network data instances;
- using each of a plurality of local analyzers corresponding to a local portion of the plurality of traffic monitors, deriving at least one 2D matching feature, wherein the 2D matching feature comprises one of a matched inbound/outbound key pair and an unmatched inbound/outbound key pair associated with the corresponding data connection;
- using at least one global analyzer, matching a first unmatched inbound/outbound key pair derived by a first local analyzer to a second unmatched inbound/outbound key pair derived by a second local analyzer to adjust the at least one 2D matching feature to generate an adjusted 2D matching feature when the at least one 2D matching feature comprises the unmatched inbound/outbound key pair;
- and
- detecting a denial of service attack based on one of the at least one 2D matching feature and the adjusted 2D matching feature.
An apparatus for detecting a distributed denial of service attack to a networked device comprising:
- a plurality of traffic monitors each for monitoring a corresponding plurality of network data instances flowing across a corresponding data connection to generate a corresponding plurality of inbound and outbound keys each extracted from a unidirectional portion of the corresponding plurality of network data instances;
- a plurality of local analyzers each corresponding to a local portion of the plurality of traffic monitors for deriving at least one 2D matching feature, wherein the 2D matching feature comprises one of a matched inbound/outbound key pair and an unmatched inbound/outbound key pair associated with the corresponding data connection;
- and
- at least one global analyzer for matching a first unmatched inbound/outbound key pair derived by a first local analyzer to a second unmatched inbound/outbound key pair derived by a second local analyzer to adjust the at least one 2D matching feature to generate an adjusted 2D matching feature when the at least one 2D matching feature comprises the unmatched inbound/outbound key pair,
- wherein a denial of service attack is detected by one of the plurality of local analyzers and the at least one global analyzer based on one of the at least one 2D matching feature and the adjusted 2D matching feature.
Dependencies are inferred from the claim text.