Distributed denial of service congestion recovery using split horizon DNS

1. A method for congestion recovery of a local network during a denial of service attack, comprising:

creating a split horizon zone on a hardware server, wherein the split horizon zone comprises a fictitious zone, and wherein the fictitious zone maps Internet Protocol (IP) addresses of a host to an address outside of the local network;

creating a general split horizon zone for non-malicious clients;

receiving and investigating a plurality of requests from a plurality of clients;

designating a malicious client from the plurality of clients based on investigating the plurality of requests, wherein the malicious client is associated with a client address;

assigning the client address to the fictitious zone;

altering the general split horizon zone to further limit malicious client access; and

routing network traffic from the malicious client to the address outside of the local network.

2. The method of claim 1 , further comprising:

updating the split horizon zones dynamically.

3. The method of claim 1 , wherein designating the malicious client is handled by an Intrusion Detection System (IDS).

4. The method of claim 1 , wherein assigning the client address comprises assigning a unique IP address of the malicious client to the fictitious zone.

5. The method of claim 1 , wherein assigning the client address comprises assigning an entire sub-network of the malicious client to the fictitious zone.

6. The method of claim 1 , wherein the malicious client is sent to the address outside of the local network by rewriting portions of a response sent to the malicious client.

7. The method of claim 1 , wherein the address outside of the local network is a non-routable address.

8. The method of claim 1 , wherein the address outside of the local network is an address of the malicious client.

9. A system for denial of service attack congestion recovery of a local network, comprising:

a plurality of clients with a processor comprising functionality to execute software instructions for sending a plurality of requests, wherein the plurality of requests comprise requests for a plurality of Internet Protocol (IP) addresses;

a domain name system (DNS) server comprising a processor, and communicatively coupled to the plurality of clients and configured for:

creating a split horizon zone, wherein the split horizon zone comprises a fictitious zone, and wherein the fictitious zone maps IP addresses of a host to an address outside of the local network,

creating a general split horizon zone for non-malicious clients;

receiving and investigating a plurality of requests from the plurality of clients,

designating a malicious client from the plurality of clients based on investigating the plurality of requests, wherein the malicious client is associated with a client address,

assigning the client address to the fictitious zone,

altering the general split horizon zone to further limit malicious client access; and

routing network traffic from the malicious client to the address outside of the local network;

an intrusion detection system (IDS) communicatively coupled to the plurality of clients and the DNS server.

10. The system of claim 9 , wherein the DNS server and the IDS reside on the same machine.

11. A non-transitory computer readable medium storing instructions for congestion recovery during a denial of service attack, the instructions comprising functionality to:

create a split horizon zone on a server, wherein the split horizon zone comprises a fictitious zone, and wherein the fictitious zone maps Internet Protocol (IP) addresses of a host to an address outside of the local network;

create a general split horizon zone for non-malicious clients;

receive and investigate a plurality of requests from a plurality of clients; designate a malicious client from the plurality of clients based on investigating the plurality of requests;

assign the address of the malicious client to the fictitious zone;

alter the general split horizon zone to further limit malicious client access; and

route network traffic from the malicious client to the address outside of the local network.

12. The non-transitory computer readable medium of claim 11 , further comprising instructions comprising functionality to:

update the split horizon zones dynamically.

13. The non-transitory computer readable medium of claim 11 , wherein designating the malicious client is handled by an Intrusion Detection System (IDS).

14. The non-transitory computer readable medium of claim 11 , wherein assigning the client address comprises assigning a unique IP address of the malicious client to the fictitious zone.

15. The non-transitory computer readable medium of claim 11 , wherein assigning the client address comprises assigning an entire sub-network of the malicious client to the fictitious zone.

16. The non-transitory computer readable medium of claim 11 , wherein the malicious client is sent to the address outside of the local network by rewriting portions of a response sent to the malicious client.

17. The non-transitory computer readable medium of claim 11 , wherein the address outside of the local network is a non-routable address.

18. The non-transitory computer readable medium of claim 11 , wherein the address outside of the local network is the address of the malicious client.