System and method for denial of service attack mitigation using cloud services

A system for mitigating an attack on a network, the system comprising:

• a subscriber monitoring device monitoring network traffic between a subscriber network and a service provider network, and determining if the subscriber network is under attack and determining a fingerprint for the attack, wherein the attack fingerprint comprises at least one of one or more source IP addresses of the packets that make up the attack, one or more destination IP addresses of the packets that make up the attack, characteristics of packet payloads related to the packets that make up the attack and port numbers that are under attack;
• a service provider mitigation system, in which the subscriber monitoring device and the service provider mitigation system send and receive asynchronous status messages to each other using a stateless protocol, the service provider mitigation system providing mitigation, the mitigation including dropping packets generated by attackers based on, at least in part, the attack fingerprint while the subscriber network is under attack, the mitigation being in response to a requested mitigation via a mitigation request from the subscriber monitoring system, wherein said mitigation request includes the attack fingerprint and wherein the subscriber monitoring device sends a request to terminate the mitigation in response to an amount of network traffic dropped by the service provider mitigation system as indicated by status messages from the service provider mitigation system and an amount of network traffic received from the service provider mitigation system following the mitigation, wherein the service provider mitigation system further comprises a plurality of sensors and communication devices providing data communication and transmission of packets across the service provider network,
• wherein each status message sent between the subscriber monitoring device and the service provider monitoring system includes an arrival time of a most recently received status message and a timestamp of when the respective status message was sent.

A networking system, comprising:

• a subscriber monitoring device monitoring network traffic between a subscriber network and a service provider network, and determining if the subscriber network is under attack and determining a fingerprint for the attack, wherein the attack fingerprint comprises at least one of one or more source IP addresses of the packets that make up the attack, one or more destination IP addresses of the packets that make up the attack, characteristics of packet payloads related to the packets that make up the attack and port numbers that are under attack;
• and
• a mitigation system, in which the subscriber monitoring device and the service provider mitigation system send and receive asynchronous status messages to each other using a stateless protocol, the mitigation system including a scrubbing system for providing mitigation by dropping packets that are part of a denial of service attack based on, at least in part, the attack fingerprint, wherein the mitigation system, in response to the subscriber monitoring system signaling an attack via a mitigation request that includes the attack fingerprint, directing traffic destined for the subscriber network first to the scrubbing center and then back to the subscriber network, wherein the mitigation system further comprises a plurality of sensors and communication devices providing data communication and transmission of packets across the service provider network, and
• wherein the subscriber monitoring device sends a request to terminate the mitigation in response to an amount of network traffic dropped by the scrubbing system as indicated by status messages from the mitigation system and an amount of network traffic directed from the scrubbing center back to the subscriber network,
• wherein each status message sent between the subscriber monitoring device and the service provider monitoring system includes an arrival time of a most recently received status message and a timestamp of when the respective status message was sent.

A networking system, comprising:

• a subscriber monitoring device monitoring network traffic between a subscriber network and a service provider network and determining if the subscriber network is under attack and a fingerprint for the attack, wherein the attack fingerprint comprises at least one of one or more source IP addresses of the packets that make up the attack, one or more destination IP addresses of the packets that make up the attack, characteristics of packet payloads related to the packets that make up the attack and port numbers that are under attack;
• and
• a mitigation system, in which the subscriber monitoring device and the service provider mitigation system send and receive asynchronous status messages to each other using a stateless protocol, the mitigations system including a scrubbing system, for providing mitigation by dropping packets that are part of a denial of service attack based on the fingerprint, wherein the mitigation system further comprises a plurality of sensors and communication devices providing data communication and transmission of packets across the service provider network, and
• wherein the subscriber monitoring device terminates the mitigation in response to a total of an amount of network traffic dropped by the scrubbing system as indicated by status messages from the mitigation system and an amount of network traffic directed from the mitigation system to the subscriber network via the service provider network,
• wherein each status message sent between the subscriber monitoring device and the service provider monitoring system includes an arrival time of a most recently received status message and a timestamp of when the respective status message was sent.