Detecting and addressing network attacks
A method and system are provided for preventing network service shutdowns resulting from denial of service (DOS) attacks. First, parameters are monitored corresponding to network elements carrying communication signal traffic in a communications network, and, based on the parameters, if a DOS attack is indicated, performing the following for each instance of communication signal traffic: accessing data structures for data relating to protected communication signal traffic, and, based on the data, determining if the communication signal traffic is designated as protected. Finally; based on the determination, cleaning and forwarding each protected communication signal to its respective destination.
1. One or more non-transitory computer-readable storage media containing computer readable instructions embodied thereon that, when executed by a computing device, perform a method for reducing an amount of communications traffic from being dropped in a service provider network due to a malicious attack, the method comprising:
monitoring network resource usage corresponding to network elements;
carrying communication signal traffic in a communications network, wherein the communication signal traffic comprises one of an emergency traffic signal and a traffic signal directed to a detection and mitigation protection service subscribing customer; and
based on the network resource usage, if a malicious attack is indicated, then performing the following for each signal of the communication signal traffic;
accessing a data store for data relating to the detection and mitigation protection service subscribing customer;
based on the data, determining if the communication signal traffic is directed to the detection and mitigation protection service subscribing customer; and
based on the determination, cleaning each communication signal directed to the detection and mitigation protection service subscribing customer.
2. The one or more non-transitory computer-readable storage media of claim 1 , wherein the network resource usage comprises bandwidth usage statistics.
3. The one or more non-transitory computer-readable storage media of claim 2 , wherein cleaning each communication signal directed to the detection and mitigation protection service subscribing customer comprises:
isolating attacking communication signals from legitimate communication signals; and
forwarding each of the legitimate communication signals to its respective destination.
4. The one or more non-transitory computer-readable storage media of claim 3 , further comprising dropping communication signal traffic that is not directed to the detection and mitigation protection service subscribing customer until the malicious attack subsides.
5. The one or more non-transitory computer-readable storage media of claim 2 , further comprising:
monitoring the bandwidth-usage statistics relating to the network elements in the service provider network;
receiving and processing anomalous bandwidth-usage statistics via a processing system; and
determining at the processing system if the anomalous bandwidth-usage statistics are indicative of a malicious attack.
6. The one or more non-transitory computer-readable storage media of claim 1 , wherein the accessing a data store further comprises differentiating between a protected inbound communications signal and an unprotected inbound communications signal.
7. The one or more non-transitory computer-readable storage media of claim 6 , wherein the protected inbound communications signal comprises a signal directed towards the detection and mitigation protection service subscribing customer.
8. The one or more non-transitory computer-readable storage media of claim 1 , further comprising determining a total number of detectors required to centralize detection services for the service provider network.
9. The one or more non-transitory computer-readable storage media of claim 8 , wherein said determining is a function of a respective allotted bandwidth for each of the detection and mitigation protection service subscribing customers.
10. A service provider network detection architecture, comprising:
monitoring tools to collect data and statistics relevant to infrastructure elements of the service provider network and determine if the service provider network may be under an attack;
a data store coupled to the service provider network detection architecture and comprising data on protected inbound communication signal traffic;
a differentiator to access the data store and determine if the protected inbound communication signal traffic is affected by the attack;
a router or switch to separate the protected inbound communication signal traffic from unprotected inbound communication signal traffic; and
a cleaning center to receive and separate the protected inbound communication signal traffic between attacking traffic and legitimate traffic.
11. The service provider network detection architecture of claim 10 , wherein the monitoring tools determine changes in a network element's usage statistics over a period of time.
12. The service provider network detection architecture of claim 11 , wherein the network elements comprise at least one of a processor, a communication signal pathway, a port, and a router.
13. The service provider network detection architecture of claim 11 , wherein the usage statistics comprise bandwidth usage statistics.
14. The service provider network detection architecture of claim 10 , wherein the monitoring tools comprise a link utilization monitor to monitor bandwidth usage statistics of the service provider network.
15. The service provider network detection architecture of claim 10 , wherein the differentiator processes anomalous bandwidth-usage statistics and determines if the anomalous bandwidth-usage statistics are indicative of an attack.
16. The service provider network detection architecture of claim 10 , wherein the attack comprises a denial of service (DOS) attack.
17. The service provider network detection architecture of claim 10 , wherein the router or switch comprises a splitter.
18. The service provider network detection architecture of claim 10 , wherein the protected inbound communication signal traffic comprises detection and mitigation protection service subscribing customers.
19. The service provider network detection architecture of claim 18 , wherein the protected inbound communication signal traffic further comprises emergency communication signal traffic.
20. A method for reducing an amount of communications traffic from being dropped in a service provider network due to a malicious attack, the method comprising:
monitoring network resource usage via network elements, wherein the network elements comprise at least one of a processor, a communication signal pathway, a port, and a router;
carrying communication signal traffic in a communications network, wherein the communication signal traffic comprises one of an emergency traffic signal and a traffic signal directed to a detection and mitigation protection service subscribing customer; and
based on the network resource usage, if a malicious attack is indicated, then performing the following for each signal of the communication signal traffic;
accessing a data store for data relating to the detection and mitigation protection service subscribing customer;
based on the data, determining if the communication signal traffic is directed to the detection and mitigation protection service subscribing customer; and
based on the determination, cleaning each communication signal directed to the detection and mitigation protection service subscribing customer.