System and method for mitigating a denial of service attack in a subscriber network
View Patent ↗A system and method for mitigating a denial of service attack in a subscriber network. A traffic monitor monitors bandwidth usage of a subscriber network that is directed to a particular port. The traffic monitor detects excessive traffic based on preset thresholds or algorithms. When excessive traffic is detected, the traffic monitor may obtain the source IP address from headers in the packet stream and identify the device or devices from which the packets were delivered to the network. Using the IP addresses of affected devices, a policy may be implemented to throttle packets originating from those devices that are directed to the particular port.
1. A method for mitigating a denial of service attack in a subscriber network comprising:
monitoring upstream packets in a region of the subscriber network using a traffic monitor;
detecting excess upstream packets directed to a port in the region of the subscriber network using the traffic monitor, wherein the port is identified by a port number;
obtaining by the traffic monitor an identifier of a subscriber device identified as a source of the excess upstream packets, wherein the subscriber device is connected to the subscriber network via one of a plurality of regional cable modem termination systems (CMTSs);
reporting the subscriber device identifier to a national policy server;
applying by the national policy server a policy to the identifier of the subscriber device, wherein the policy limits the upstream bandwidth for upstream packets originating from the subscriber device directed to the port number;
reporting the policy, the port number and the identifier of the subscriber device to regional policy server, wherein the regional policy server is in communication with the plurality of regional CMTSs;
identifying by the regional policy server the one of the plurality of regional CMTSs to which the subscriber device identified by the identifier is connected;
reporting by the regional policy server the policy to the identified one of the plurality of regional CMTSs: and
enforcing by the one of the plurality of regional CMTSs the policy against the identifier of the subscriber device.
2. The method of claim 1 , wherein the subscriber device is a cable modem.
3. The method of claim 1 , wherein the policy is associated with a service flow and wherein applying the policy to the subscriber device comprises applying the service flow to the subscriber device.
4. The method of claim 1 , wherein the identifier is the IP address of the subscriber device.
5. The method of claim 1 , wherein the port number is associated with an application that is selected from the group defined as well-known ports (0-1023) and/or registered ports (>1023) as defined in RFC 1700.
6. The method of claim 1 , wherein detecting excess upstream packets directed to a port in the region of the subscriber network comprises:
establishing a baseline volume of packets comprising the port number for a network node at a particular time;
measuring the actual volume of packets comprising the port number at the network node at the particular time;
comparing the baseline volume to the actual volume; and
when the actual volume exceeds the baseline volume by a pre-set amount, determining that excess upstream packets directed to the port have been detected.
7. A system for mitigating a denial of service attack in a subscriber network comprising:
the subscriber network, wherein the subscriber network comprises regions;
a traffic monitor comprising a first processor, wherein the first processor is configured with executable instructions to cause the traffic monitor to perform operations comprising:
monitoring upstream packets in a region of the subscriber network;
detecting excess upstream packets directed to a port in the region of the subscriber network, wherein the port is identified by a port number;
obtaining an identifier of a subscriber device identified as a source of the excess upstream packets, wherein the subscriber device is connected to the subscriber network via one of a plurality of regional cable modem termination systems (CMTSs); and
reporting the identifier to a national policy server;
the national policy server, wherein the national policy server comprises a second processor, wherein the second processor is configured with executable instructions to cause the national policy server to perform operations comprising:
applying a policy to the identifier of the subscriber device, wherein the policy limits the upstream bandwidth for upstream packets originating from the subscriber device directed to the port number;
reporting the policy, the port number and the identifier of the subscriber device to a regional policy server, wherein the regional policy server is in communication with the plurality of regional CMTSs; and
the regional policy server, wherein the regional policy server comprises a third processor, wherein the third processor is configured with executable instructions to cause the regional policy server to perform operations comprising:
identifying by the regional policy server the one of the plurality of regional CMTSs to which the subscriber device identified by the identifier is connected;
reporting by the regional policy server the policy to the identified one of the plurality of regional CMTSs,
wherein the identified one of the plurality of regional CMTSs comprises a fourth processor and wherein the fourth processor is configured with executable instructions to cause the identified one of the plurality of regional CMTSs to perform operations comprising enforcing the policy against the identifier of the subscriber device.
8. The system of claim 7 , wherein the subscriber device is a cable modem.
9. The system of claim 7 , wherein the policy is associated with a service flow and wherein the operation of applying the policy to the subscriber device comprises applying the service flow to the subscriber device.
10. The system of claim 7 , wherein the identifier is the IP address of the subscriber device.
11. The system of claim 7 , wherein the port number is associated with an application that is selected from the group defined as well-known ports (0-1023) and/or registered ports (>1023) as defined in RFC 1700.
12. The method of claim 7 , wherein the operation of detecting excess upstream packets directed to a port in the region of the subscriber network comprises:
establishing a baseline volume of packets comprising the port number for a network node at a particular time;
measuring the actual volume of packets comprising the port number at the network node at the particular time;
comparing the baseline volume to the actual volume; and
when the actual volume exceeds the baseline volume by a pre-set amount, determining that excess upstream packets directed to the port have been detected.
13. The method of claim 1 ,
wherein obtaining by the traffic monitor an identifier of a subscriber device comprises:
obtaining a source IP address from an upstream packet originating from the subscriber device;
conveying the source IP address to a datastore, wherein the datastore comprises a mapping of source IP addresses to subscriber device media access control (MAC) addresses; and
obtaining from the datastore a MAC address of the subscriber device, and
wherein the method further comprises:
receiving by the national policy server the MAC address of the subscriber device;
conveying by the national policy server the MAC address of the subscriber device to the datastore; and
receiving by the national policy server a most current IP address associated with the MAC address of the subscriber device; and
using by the national policy server the most current IP address as the identifier of the subscriber device.
14. The system of claim 7 ,
wherein the operation of obtaining by the traffic monitor an identifier of a subscriber device comprises:
obtaining a source IP address from an upstream packet originating from the subscriber device;
conveying the source IP address to a datastore, wherein the datastore comprises a mapping of source IP addresses to subscriber device media access control (MAC) addresses; and
obtaining from the datastore a MAC address of the subscriber device, and
wherein the second processor is further configured with executable instructions to cause the national policy server to perform operations comprising:
receiving the MAC address of the subscriber device;
conveying the MAC address of the subscriber device to the datastore;
receiving a most current IP address associated with the MAC address of the subscriber device, and
using the most current IP address as the identifier of the subscriber device.