Thwarting source address spoofing-based denial of service attacks

A method of protecting a victim data center against a denial of service attack, the method comprising:

• receiving packets with faked, random source addresses;
• receiving, from a gateway disposed near the victim data center, a notification that the victim data center is under an attack;
• sending queries to data collectors deployed at different points in a network that carries network traffic to the victim data center, the data collectors to sample network packets and collect statistical information on network packets sent over the network, the queries being requests for statistical information from data collectors that have examined network traffic with victim destination address;
• and
• determining a data center or centers involved in the attack on the victim data center by analyzing collected statistical information from the data collectors, wherein the analyzing comprises aggregating statistical information of traffic flows from a source address and source port to a destination address and destination port, measured over different periods of time.

A system to thwart denial of service attacks on a victim data center, the system comprising:

• a plurality of data collectors monitors dispersed throughout a network, the data collectors monitors collecting statistical data on network traffic;
• a control center coupled to the plurality of data collectors, the control center, comprising
• a memory;
• a processor;
• and
• a computer readable medium storing a computer program product, the computer readable medium comprising instructions for causing the control center to:
• receive from the data center a notification that the victim data center is under an attack;
• and in response to receiving the notification,
• send queries to data collectors to request statistical information collected by the data collectors based on network traffic, the statistical information used to determine a source of suspicious network traffic being sent to the data center, wherein determining a source of suspicious network traffic comprises aggregating statistical information of traffic flows from a source address and source port to a destination address and destination port, measured over different periods of time;
• a gateway device that passes network packets between the network and the data center, the gateway disposed to protect the victim data center, and being coupled to the control center.

A computer program product residing on a computer readable storage media for protecting a victim data center against a denial of service attack, the computer program product, comprising instructions for causing a computing device to:

• receive a notification that the victim data center is under an attack;
• send queries to data collectors deployed at different points in a network that carries network traffic to the victim data center, the data collectors to sample network traffic and collect statistical information on packets sent over the network, the queries to request statistical information from data collectors that have examined network traffic with the victim destination address;
• and
• determine a source of the attack on the victim data center by analyzing collected information from the data collectors, wherein the analyzing comprises aggregating statistical information of traffic flows from a source address and source port to a destination address and destination port, measured over different periods of time.