Method and apparatus for detecting abnormal traffic in a network
View Patent ↗A method of identifying traffic within a network representative of an abnormal network condition, including: monitoring a communications link for a high traffic volume level; identifying a domain being the source of the high traffic volume level; identifying within the domain, a sending entity transmitting traffic from the domain; using a detector located at or proximate to the domain to invoke a response from the sending entity; wherein a failure by the sending entity to provide an expected response to the message in accordance with a network protocol indicates that the traffic transmitted by the sending entity is traffic representative of an abnormal network condition.
1. A method of identifying traffic within a network representative of an abnormal network condition, including
monitoring, via one or more computer processing devices, a communications link for a high traffic volume level,
identifying a domain being the source of the high traffic volume level,
identifying within the domain, a sending entity transmitting traffic from the domain,
using a detector located at or proximate to the domain to invoke a response from the sending entity, wherein
a failure by the sending entity to provide an expected response to the message in accordance with a network protocol indicates that the traffic transmitted by the sending entity is traffic representative of an abnormal network condition.
2. The method of identifying a party associated with traffic within a network representative of an abnormal network condition, including the method of claim 1 , wherein
the sending entity who fails to provide the expected response is a party associated with the traffic of an abnormal network condition.
3. The method according to claim 1 wherein the high traffic volume is transmitted at a high transmission rate.
4. The method according to claim 1 wherein
the abnormal network condition is indicative of a denial of service attack by the sending entity.
5. The method according to claim 1 wherein
the abnormal network condition is indicative of an operational fault involving the sending entity.
6. The method according to claim 1 further including the step of blocking further traffic transmitted by the sending entity.
7. The method according to claim 1 wherein
at least one sending entity is an automated entity.
8. The method according to claim 1 wherein
the sending entity transmits Transport Control Protocol (TCP) traffic, and wherein
the expected response by the sending entity comprises at least one of either re-transmitting previously-sent traffic, or reducing its transmission rate.
9. The method according to claim 8 wherein
the detector sends a negative acknowledgement (NACK) message.
10. The method according to claim 8 wherein
the detector blocks or delays onward transmission of a message addressed to the sending entity, which acknowledges receipt of traffic transmitted by the sending entity.
11. The method according to claim 1 wherein
the detector sends a choke packet and wherein the expected response by the sending entity comprises reducing its transmission rate.
12. The method according to claim 11 wherein
the choke packet comprises an Internet Message Control Protocol (ICMP) Source Quench message.
13. The method according to claim 11 wherein
the sending entity transmits User Datagram Protocol (UDP) traffic.
14. The method according to claim 1 wherein
the monitoring of the communications link comprises at least one of either detecting anomalies in traffic patterns, or detecting traffic having a pre-defined attack characteristic.
15. An apparatus for identifying traffic representative of an abnormal network condition, including
a monitor arranged to monitor, via one or more computer processing devices, a communications link for a high traffic volume level,
a domain identifier arranged to identify a domain being the source of the high traffic volume level,
a sending entity identifier arranged to identify a sending entity transmitting traffic from the domain,
a detector arranged to invoke a response from the sending entity, and
a detector arranged to detect a failure by the sending entity to provide an expected response to the message in accordance with a network protocol, the failure being indicative that the traffic transmitted by the sending entity is traffic representative of an abnormal network condition.
16. The apparatus for identifying a party associated with traffic within a network representative of an abnormal network condition using the apparatus of claim 15 , wherein
the sending entity who fails to provide the expected response is a party associated with the traffic of an abnormal network condition.
17. The apparatus according to claim 15 further including a blocker arranged to 10 block further traffic transmitted by the sending entity.
18. The apparatus according to claim 15 wherein the detector is located in, at or proximate to the domain.
19. The apparatus according to claim 15 wherein the detector is co-located with a router of the domain.
20. An installation comprising a telecommunications network, further including an apparatus according to claim 15 .
21. A method of operating, via one or more computer processing devices, an apparatus according to claim 15 .