Architecture to thwart denial of service attacks
View Patent ↗An arrangement is disposed in a network. The arrangement includes a device that is logically disposed adjacent logically nearby routers having a first type of probe that are disposed to sample traffic, and that is has second type of probe that is disposed in-line during an attack by modifying router tables on the nearby routers.
1. An arrangement disposed in a network, the arrangement comprises:
a monitoring device that is logically disposed adjacent to logically nearby routers, the monitoring device including:
a first type of probe that is disposed to sample traffic; and
a second type of probe disposed in-line in response to sampling of traffic based on detection of an event corresponding to an attack on a data center with the monitoring device executing routing changes on nearby routers to redirect packets with destination addresses for the data center under attack to the second type of probe.
2. The arrangement of claim 1 wherein when the attack has ended, a new routing change is deployed to have traffic rerouted back to the original route that existed prior to rerouting through the second probe.
3. The arrangement of claim 1 wherein the monitor device applies a filter on the second type probe.
4. The arrangement of claim 1 wherein the monitor device executes a routing change by logging into the router and updating the router table.
5. The arrangement of claim 1 wherein during the attack, the second type probe reports statistics on packet traffic sent to a cluster head so that the cluster head can detect when the attack has ended.
6. The arrangement of claim 1 wherein during the attack, the second type probe reports an observed hit rate of the filter to a cluster head to determine when the attack has ended.
7. The arrangement of claim 5 wherein when the attack has ended, the monitor device communicates a new routing change to have traffic rerouted back to the original route that existed prior to rerouting through the second probe and to notify the second probe to remove the filter.
8. The arrangement of claim 4 wherein if the attack is still occurring, but the malicious traffic characteristics have changed, another filter is installed on the second probe.
9. The arrangement of claim 1 wherein the monitor device further comprises:
a communication process that communicates collected statistics concerning the traffic with a control center and that can receive queries or instructions from the control center.
10. The arrangement of claim 1 wherein the communication process couples to a dedicated link to communicate with the control center over a hardened network.
11. A device comprises:
a cluster head;
a plurality of passive probes disposed between a network and a data center, the passive probes collecting statistical data on network packets that are sampled by the passive probes to analyze the statistical data and report the collected statistical data to the cluster head; and
a plurality of active probes disposed in-line in the network to receive network packet traffic having a destination address for the data center, the active probes provided to filter the network traffic intended for the data center with the active probes each having at least one enforcement filter configured to drop packets having the destination address of the data center and that the cluster head deems malicious traffic;
wherein the cluster head applies the filter on the active probes via an out-of-band connection executing a routing change and updating router tables on nearby routers.
12. The device of claim 11 wherein router tables are modified to route traffic with the destination address of the data center through at least one of the active probes during an attack.
13. The device of claim 11 wherein the active probes report statistics on the traffic to the cluster head so that the cluster head can detect when the attack has ended.
14. The device of claim 11 wherein when the attack has ended, the device communicates a new routing change to have traffic rerouted back to the original route that existed prior to rerouting through the probe.
15. The device of claim 11 wherein the cluster head comprises:
a communication process that communicates collected statistics concerning the traffic with a control center and that receives queries and instructions from the control center.
16. The device of claim 11 wherein the communication process couples to a dedicated link to communicate with a control center over a hardened network.