Mitigating denial of service attacks by leveraging geographical locations of network edges
A system analyzes network traffic at the network edge in a Point-of-Presence (POP) to prevent denial of service attacks, such a reflection attack, and filters such attack traffic. The POP can analyze a source identifier of the network traffic, such as a source prefix, and compare the source identifier to known source identifiers from the same geographic region as the POP. If the source identifier is outside of the POPs geographic region, then the network traffic is rate limited, such as by blocking the network traffic or reducing the network traffic to a desired threshold. To further ensure that the traffic is routed to the appropriate POP, the POP edge location announces anycast addresses for receiving the network traffic. The geographic region can be defined as a city, a country, sub-regions within a country, a portion of a continent (e.g., southeast region of Asia), a continent, etc.
1 . A method of identifying and mitigating a distributed denial of service (DDoS) attack, the method comprising:
receiving a list of acceptable source prefixes of content providers in a Point-of-Presence (POP) edge location of a network, wherein the acceptable source prefixes are based upon a history of source prefixes being received within a same geographic region as the POP edge location;
storing the list of the acceptable source prefixes, of content providers, at the POP edge location for analysis of network traffic propagating through the POP edge location;
receiving network traffic with a source prefix of a content provider for forwarding to a destination server computer through a networking service;
comparing the source prefix to the list of acceptable source prefixes;
if the source prefix is not on the list of acceptable source prefixes, which are associated with the same geographic region as the POP edge location, rate limiting the network traffic from accessing the networking service; and
if the source prefix is on the list of acceptable source prefixes, transmitting the network traffic to the networking service without rate limiting for forwarding to the destination server computer.
2 . The method of claim 1 , wherein the POP edge location announces anycast addresses for receiving network traffic.
3 . The method of claim 1 , wherein the rate limiting includes blocking the network traffic.
4 . The method of claim 3 , wherein the same geographic region is one of the following: a same city, a same country, a same group of countries, a same continent or a latency-based distance between a source computer associated with the source prefix and the POP.
5 . The method of claim 1 , further including storing a configuration file associated with the destination server computer and retrieving the rate limiting from the configuration file.
6 . The method of claim 1 , wherein the receiving of the network traffic is accomplished using Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or Internet Control Message Protocol (ICMP).
7 . A method, comprising:
receiving network traffic in a Point-of-Presence (POP) edge location of a network, wherein the POP is in a geographic region;
comparing a source identifier of the network traffic to known source identifiers within a same geographic region as the POP;
determining that the source identifier does not match one of the known source identifiers for the geographic region in which the POP is located, wherein the source identifier is associated with a source of content to be delivered to a destination server computer; and
identifying the network traffic as a denial of service (DoS) attack and rate limiting the network traffic associated with the source identifier.
8 . The method of claim 7 , wherein the rate limiting includes blocking the network traffic.
9 . The method of claim 7 , wherein the source identifier includes a prefix of a network address and the known source identifiers are known prefixes and the comparison includes comparing the prefix of the network address against the known prefixes.
10 . The method of claim 7 , further including determining an amount of the rate limiting by checking a configuration file including a rate limiting parameter controlled by an entity associated with a destination address of the network traffic or controlled by a networking service associated with the POP.
11 . The method of claim 10 , wherein the configuration file includes different rate limiting parameters for different destination addresses.
12 . The method of claim 7 , wherein the POP edge location is one of multiple POP edge locations that are included in an anycast networking service.
13 . The method of claim 7 , further including:
capturing history data for source identifiers and geographic regions associated with the source identifiers;
transmitting the captured history data to the POP edge location; and
storing the captured history data at the POP edge location and using the stored captured history data to perform the comparing of the source identifier to the known source identifiers.
14 . The method of claim 7 , wherein the same geographic region is one of the following: a same city, a same country, a same group of countries, a same continent, or a physical distance between the POP and a source computer associated with the source identifier or a networking distance between the POP and the source computer.
15 . The method of claim 7 , wherein the receiving of the network traffic is accomplished using Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or Internet Control Message Protocol (ICMP).
16 . A system of identifying and mitigating a denial of service (DoS) attack, comprising:
a plurality of a Point-of-Presence (POP) edge locations of a network, wherein the POP edge locations are located in different geographic regions, wherein a first of the POP edge locations includes a controller and a storage device storing instructions executable by the controller to:
receive network traffic from a source identifier in the first POP edge location, wherein the source identifier is associated with a server computer that supplies content and the network traffic is content to be supplied to a destination server computer;
compare the source identifier to stored source identifiers known to be from a same geographic region as a geographic region of the first POP edge location; and
as a result of determining that the source identifier does not match any of the stored source identifiers based on the source identifier being associated with a different geographic region than the geographic region of the first POP edge location, identify the network traffic as a denial of service (DoS) attack and rate limit the network traffic associated with the source identifier.
17 . The system of claim 16 , wherein the source identifier includes a prefix of a network address and the stored source identifiers are known prefixes and the determining includes comparing the prefix of the network address against prefixes of the stored source identifiers.
18 . The system of claim 16 , wherein the first POP edge location is one of multiple POP edge locations that are included in an anycast service provider network.
19 . The system of claim 16 , wherein the rate limiting is controlled by a networking service or an entity associated with a destination of the network traffic through a configuration file stored at the first POP edge location.
20 . The system of claim 16 , wherein the receiving of the network traffic is accomplished using Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or Internet Control Message Protocol (ICMP).