Distributed denial-of-service attack mitigation by selective black-holing in IP networks
In an IP network during a DDoS attack on a website or other internet entity having an IP address, selective black-holing of attack traffic is performed such that some of the traffic destined for the IP address under attack continues to go to the IP address under attack while other traffic, destined for the same IP address is, rerouted via BGP sessions to a black-hole router. Such a selective black-holing scheme can be used to allow some traffic to continue in route to the IP address under attack, while other traffic is diverted.
1. A method of black-holing internet traffic in an internet service provider network, the method comprising:
injecting, by a first router, an instruction into the internet service provider network;
responding to the instruction, by a plurality of routers within the internet service provider network, such that a first number of routers become black-holing routers and a second number of routers become non-black-holing routers;
routing internet traffic addressed for a first IP address, by the non-black-holing routers, to an internet application having the first IP address; and
routing internet traffic addressed for the first IP address, by the black-holing routers, to a black-hole router having the first IP address,
wherein routing internet traffic is consistent routing requiring the black-holing routers to route traffic having the first IP address to other black-holing routers and wherein the non-black-holing routers route the first IP address to other non-black-holing routers.
2. The method of claim 1 , wherein the instruction is a dynamic routing protocol instruction.
3. The method of claim 1 , wherein the instruction provides a black-holing route injected into a Border Gateway Protocol.
4. The method of clam 1 , wherein each black-holing router provides the Internet traffic, routed toward the black-hole router, to a next-hop black-holing router.
5. The method of claim 1 , further comprising, changing the number of the first number of routers and the second number of routers in real-time.
6. The method of claim 1 , wherein the route to the black-hole router having the first IP address has a preference higher than a preference for the route to the internet application having the first IP address.
7. An internet service provider network comprising:
a first router in communication with the internet service provider network;
an internet application, having a first IP address, in communication with the first router, the first router directing internet traffic to the first IP address of the internet application; and
a second router, configured as a black-hole router, in communication with the internet service provider network, the second router configured to receive internet traffic that was originally addressed to the first IP address, but was re-routed through a number of predetermined routers within the internet service provider network, the number of predetermined routers being less than all the routers in the internet service provider ISP network, wherein the internet traffic addressed to the first IP address, but rerouted through predetermined routers comprises both attack and legitimate traffic.
8. The internet service provider network of claim 7 , wherein the attack traffic comprises at least one of PING and SYN messages.
9. The internet service provider network of claim 7 , wherein the predetermined routers create consistent routing to the second router.