Techniques for preventing attacks on computer systems and networks
View Patent ↗Techniques for detecting and responding to attacks on computer and network systems including denial-of-service (DoS) attacks. A packet is classified as potentially being an attack packet if it matches an access control list (ACL) specifying one or more conditions. One or more actions may be performed responsive to packets identified as potential attack packets. These actions may include dropping packets identified as potential attack packets for a period of time, rate limiting a port over which the potential attack packets are received for a period of time, and other actions.
1. A method comprising:
storing a set of access control lists in a content addressable memory (CAM), each access control list specifying one or more conditions;
performing one or more lookups in the CAM to identify a packet that causes a first access control list from the set of access control lists to be matched;
determining a first threshold and a second threshold associated with the first access control list, the first threshold indicating a first data rate and the second threshold indicating a second data rate;
determining a first time period and a second time period associated with the first access control list;
determining if receipt of the packet causes the first threshold to be exceeded;
upon determining that receipt of the packet causes the first threshold to be exceeded, dropping the packet and all subsequently received packets that cause the first access control list to be matched for the first period of time;
determining if receipt of the packet causes the second threshold to be exceeded but does not cause the first threshold to be exceeded; and
upon determining that receipt of the packet causes the second threshold to be exceeded but does not cause the first threshold to be exceeded, dropping the packet and, for the second period of time, dropping any subsequently received packet that causes the first access control list to be matched.
2. The method of claim 1 further comprising counting a number of dropped packets.
3. The method of claim 1 wherein determining the first threshold and the second threshold associated with the first access control list comprises:
accessing an entry in a database using the first access control list; and
determining the first threshold and the second threshold from the entry in the database.
4. The method of claim 1 wherein the CAM is a ternary CAM.
5. The method of claim 1 wherein the first access control list specifies one or more conditions for detecting a packet involved in a denial-of-service attack.
6. A method comprising:
determining a first threshold and a second threshold associated with a first access control list, the first threshold indicating a first data rate and the second threshold indicating a second data rate;
determining a first time period and a second time period associated with the first access control list;
determining if receipt of a packet, which causes the first access control list to be matched, causes the first threshold to be exceeded;
dropping the packet and all subsequently received packets that cause the first access control list to be matched for the first period of time upon determining that receipt of the packet causes the first threshold to be exceeded;
determining if receipt of the packet causes the second threshold to be exceeded but does not cause the first threshold to be exceeded; and
upon determining that receipt of the packet causes the second threshold to be exceeded but does not cause the first threshold to be exceeded, dropping the packet and, for the second period of time, dropping any subsequently received packet that causes the first access control list to be matched.
7. A system comprising:
a content addressable memory (CAM) adapted to store a set of access control lists, each access control list specifying one or more conditions; and
an attack prevention module adapted to:
perform one or more lookups in the CAM to identify a packet that causes a first access control list from the set of access control lists to be matched;
determine a first threshold and a second threshold associated with the first access control list, the first threshold indicating a first data rate and the second threshold indicating a second data rate;
determine a first time period and a second time period associated with the first access control list;
determine if receipt of the packet causes the first threshold to be exceeded;
cause the packet and all subsequently received packets that cause the first access control list to be matched to be dropped for the first period of time upon determining that receipt of the packet causes the first threshold to be exceeded;
determine if receipt of the packet causes the second threshold to be exceeded but does not cause the first threshold to be exceeded, and
upon determining that receipt of the packet causes the second threshold to be exceeded but does not cause the first threshold to be exceeded, cause the packet to be dropped and, for the second period of time, cause any subsequently received packet that causes the first access control list to be matched to be dropped.
8. The system of claim 7 wherein the attack prevention module is adapted to count a number of dropped packets.
9. The system of claim 7 wherein the attack prevention module is adapted to:
access an entry in a database using the first access control list; and
determine the first threshold and the second threshold from the entry in the database.
10. The system of claim 7 wherein the CAM is a ternary CAM.
11. The system of claim 7 wherein the first access control list specifies one or more conditions for detecting a packet involved in a denial-of-service attack.
12. A system comprising:
a memory configured to store a first access control list; and
a module configured to:
determine a first threshold and a second threshold associated with the first access control list, the first threshold indicating a first data rate and the second threshold indicating a second data rate;
determine a first time period and a second time period associated with the first access control list;
determine if receipt of a packet, which causes the first access control list to be matched, causes the first threshold to be exceeded;
cause the packet and all subsequently received packets that cause the first access control list to be matched to be dropped for the first period of time upon determining that receipt of the packet causes the first threshold to be exceeded;
determine if receipt of the packet causes the second threshold to be exceeded but does not cause the first threshold to be exceeded; and
upon determining that receipt of the packet causes the second threshold to be exceeded but does not cause the first threshold to be exceeded, cause the packet to be dropped and, for the second period of time, cause any subsequently received packet that causes the first access control list to be matched to be dropped.