Methods and devices for providing distributed, adaptive IP filtering against distributed denial of service attacks
View Patent ↗The present invention provides systems and methods for providing distributed, adaptive IP filtering techniques used in detecting and blocking IP packets involved in DDOS attacks through the use of Bloom Filters and leaky-bucket concepts to identify “attack” flows. In an exemplary embodiment of the present invention, a device tracks certain criteria of all IP packets traveling from IP sources outside a security perimeter to network devices within the security perimeter. The present invention examines the criteria and places them in different classifications in a uniformly random manner, estimates the amount of criteria normally received and then determines when a group of stored classifications is too excessive to be considered normal for a given period of time. After the device determines the criteria that excessive IP packets have in common, the device then determines rules to identify the packets that meet such criteria and filters or blocks so identified packets.
1. A device for detecting and filtering excessive Internet Protocol (IP) packets comprising:
an examining section adapted to count strings of IP packets traveling from at least one IP source outside a security perimeter to at least one network device within the security perimeter;
a system control section adapted to record indicators of the amount of counted strings, by different classifications, using an IP-address based hash function, wherein at least one of the classifications is based on a destination IP address and further vary a number of storage areas, each area used to store one or more of the indicators, to avoid a false indication of a malicious attack of IP packets; and
a monitoring section adapted to determine when an amount of stored indicators in a particular classification is greater than an amount of estimated indicators during a set period of time for a particular classification, thereby creating an overflow of stored indicators in said classification, wherein one of the indicators is an overcrowding indicator, the monitoring section further adapted to compare the value of the overcrowding indicator to a predetermined level in order to avoid a false indication of a malicious attack of IP packets.
2. The device of claim 1 , wherein the device is
part of a system that comprises a plurality of devices, said devices situated in logically concentric rings so as to define security zones; and
said devices adapted to exchange information regarding said security zones.
3. The device of claim 1 , wherein the device is a network processor.
4. The device of claim 1 , further comprising:
an estimation section adapted to estimate the amount of indicators expected to be recorded in particular classifications during the set period of time.
5. The device of claim 4 , further comprising
a determination section adapted to determine rules to identify the strings that generated the stored indicators in said overflow classification;
an identifying section adapted to identify overflow strings and excessive IP packets associated with such overflow strings using said rules; and
a filtering section adapted to filter said excessive IP packets.
6. The device of claim 5 , further comprising an identifying section adapted to identify specific destination IP addresses for which excessive IP packets are destined.
7. The device of claim 5 , further comprising a restriction section adapted to restrict resources utilized by excessive IP packets.
8. A method for detecting and filtering excessive Internet Protocol (IP) packets said method comprising the steps of:
examining strings of IP packets traveling from at least one IP source outside a security perimeter to at least one network device within the security perimeter;
recording indicators of the amount of strings, by different classifications, using an IP-address based hash function, wherein at least one of the classifications is based on a destination IP address;
varying a number of storage areas, each area used to store one or more of the indicators, to avoid a false indication of a malicious attack of IP packets; and
monitoring an amount of stored indicators to determine when the amount of stored indicators in a particular classification is greater than an amount of estimated indicators during a set period of time for a particular classification, thereby creating an overflow of stored indicators in said classification, wherein one of the indicators is an overcrowding indicator, the monitoring step further comprising the step of comparing the value of the overcrowding indicator to a predetermined level in order to avoid a false indication of a malicious attack of IP packets.
9. The method of claim 8 , wherein the amount of indicators expected to be collected and recorded is based on past traffic history.
10. The method of claim 8 , further comprising the step of applying statistical sampling to IP packets before they are examined.
11. The method of claim 8 , further comprising the steps of:
providing two or more devices in logically concentric rings so as to define security zones; and
exchanging information regarding said security zones between said devices.
12. The method of claim 8 , further comprising the steps of:
estimating the amount of indicators expected to be recorded in particular classifications during the set period of time.
13. The method of claim 12 , wherein the set period of time is based on past traffic history.
14. The method of claim 12 , wherein the amount of indicators expected to be recorded is modified based on traffic parameters.
15. The method of claim 12 , further comprising the step of smoothing out randomness in traffic parameters using a sliding window.
16. The method of claim 12 , further comprising the steps of monitoring the total number of overflowing classifications; and
altering the classification recordation manner based on the number of overflowing classifications.
17. The method of claim 12 , further comprising the steps of estimating a ratio of an expected number of indicators for strings associated with different source IP addresses compared to an expected number of indicators for strings associated with different destination IP addresses;
determining when the ratio of an actual number of indicators for strings associated with different source IP addresses compared to the actual number of indicators for strings associated with different destination IP addresses is sufficiently different than the estimated ratio; and
indicating an overflow classification when said actual ratio sufficiently differs from said estimated ratio.
18. The method of claim 12 , further comprising the steps of monitoring the rate at which the IP packets arrive;
estimating an expected rate of IP packet arrivals; and
determining when said rate of IP packet arrivals in a particular classification is greater than the estimated rate of IP packet arrivals during a set period of time thereby creating an overflow of stored indicators in said classification.
19. The method of claim 12 , further comprising the steps of:
determining rules to identify the strings that generated the recorded indicators in said overflow classification;
identifying overflow strings and excessive IP packets associated with such overflow strings using said rules; and
filtering said excessive IP packets.
20. The method of claim 19 , further comprising the step of identifying specific destination IP addresses for which excessive IP packets are destined.
21. The method of claim 19 , further comprising the step of restricting resources utilized by excessive IP packets.
22. The method of claim 21 , further comprising the step of activating alternative scheduling of IP packets at routers.
23. The method of claim 21 , further comprising the steps of activating alternative buffer management and routing schemes of the IP packets.
24. The method of claim 19 , wherein said rules are determined based on monitoring of User Data Protocol (UDP) traffic, packet size and the number of times a particular destination port number is used.
25. The method of claim 19 , wherein said rules are determined based on monitoring percentage shares of Transmission Control Protocol(TCP), User Data Protocol (UDP) and Internet Control Message Protocol (ICMP) packets.
26. The method of claim 19 , wherein said rules are determined based on monitoring packet size distributions.
27. The method of claim 19 , wherein said rules are determined based on destination port numbers.
28. The method of claim 21 , wherein said rules are determined based on the distribution of Time-To-Live values.