Mitigating low-rate denial-of-service attacks in packet-switched networks
A method includes determining, at a network routing device, an average packet drop rate for a plurality of aggregations of packet flows. The method also determines a threshold packet drop rate based on the average packet drop rate, a current packet drop rate for a select aggregation of the plurality of aggregations, and whether at least one packet flow of the select aggregation is potentially subject to a denial-of-service attack based on a comparison of the current packet drop rate to the threshold packet drop rate.
1. A method comprising:
determining, at a network routing device, an average packet drop rate for a plurality of aggregations of packet flows;
determining, at the network routing device, a threshold packet drop rate based on the average packet drop rate;
determining, at the network routing device, a current packet drop rate for a select aggregation of the plurality of aggregations; and
determining, at the network routing device, whether at least one packet flow of the select aggregation is potentially subject to a denial-of-service attack based on a comparison of the current packet drop rate to the threshold packet drop rate.
2. The method of claim 1 , further comprising:
assigning a higher priority status to packets of packet flows of the select aggregation for transmission by the network routing device in response to determining at least one packet flow of the select aggregation is potentially subject to a denial-of-service attack; and
assigning a lower priority status to packets of packet flows of the select aggregation for transmission by the network routing device in response to determining no packet flows of the select aggregation are subject to the denial-of-service attack.
3. The method of claim 2 , further comprising:
preferentially selecting for transmission by the network routing device packets having the higher priority status over packets having the lower priority status.
4. The method of claim 1 , wherein preferentially selecting for transmission packets having the higher priority status over packets having the lower priority status comprises preferentially selecting packets in accordance with at least one of an Active Queue Management policy and a Weighted Random Early Detection policy.
5. The method of claim 1 , wherein determining the average packet drop rate for the plurality of aggregations comprises determining the average packet drop rate over a time sliding window.
6. The method of claim 1 , wherein determining the current packet drop rate for the select aggregation comprises determining the current packet drop rate based on a comparison of an accumulated data size of packets for packet flows of the select aggregation input to the network routing device to an accumulated data size of packets for packet flows of the select aggregation output by the network routing device.
7. The method of claim 1 , wherein determining the threshold packet drop rate comprises one of setting the threshold packet drop rate to the greater of the average packet drop rate and a predetermined minimum packet drop rate.
8. The method of claim 1 , wherein the network routing device comprises one of: a router; a bridge; and a switch.
9. A network routing device comprising:
a line interface comprising a network input and a network output; and
an attack protection module to determine an average packet drop rate for a plurality of aggregations of packet flows, to determine a threshold packet drop rate based on the average packet drop rate, and to determine a current packet drop rate for a select aggregation, the attack protection module further to determine whether at least one packet flow of the select aggregation of packet flows is potentially subject to a denial-of-service attack based on a comparison of the current packet drop rate to the threshold packet drop rate.
10. The network routing device of claim 9 , wherein the attack protection module comprises:
a prioritization module to assign a higher priority status to packets of packet flows of the select aggregation for transmission by the network routing device in response to determining at least one packet flow of the select aggregation is potentially subject to a denial-of-service attack and to assign a lower priority status to packets of packet flows of the select aggregation for transmission by the network routing device in response to determining no packet flows of the select aggregation are subject to the denial-of-service attack.
11. The network routing device of claim 9 , wherein the line interface includes:
an output buffer coupled to the output interface; and
an output control module to preferentially select for transmission via the output interface packets in the output buffer that have the higher priority status over packets in the output buffer that have the lower priority status.
12. The network routing device of claim 11 , wherein the output control module uses at least one of an Active Queue Management policy and a Weighted Random Early Detection policy in preferentially selecting packets for transmission.
13. The network routing device of claim 9 , wherein the attack protection module includes a packet drop rate calculator to determine the average packet drop rate for the plurality of aggregations by determining the average packet drop rate over a sliding time window.
14. The network routing device of claim 9 , wherein the attack protection module includes a packet drop rate calculator comprising a first counter to count an accumulated data size of packets for packet flows of the select aggregation received by the network routing device and a second counter to count an accumulated data size of packets for packet flows of the select aggregation output by the network routing device, and wherein the packet drop rate calculator further is to determine the current packet drop rate for the select aggregation based on a comparison of a value of the first counter to a value of the second counter.
15. The network routing device of claim 9 , wherein the attack protection module includes one of a fair prioritization controller to set the threshold packet drop rate to the greater of the average packet drop rate and a predetermined minimum packet drop rate.
16. The network routing device of claim 9 , wherein the network routing device comprises one of: a router; a bridge; and a switch.
17. A method comprising:
determining, at a network routing device, a first average packet drop rate for a plurality of aggregations of packet flows for a first interval;
determining, at the network routing device, a first threshold packet drop rate based on the first average packet drop rate;
assigning, at the network routing device, a higher priority status to packets of packet flows of a select aggregation of the plurality of aggregations at a first time in response to determining a current packet drop rate of the select aggregation at the first time is greater than the first threshold packet drop rate;
determining, at the network routing device, a second average packet drop rate for the plurality of aggregations of packet flows for a second interval subsequent to the first interval;
determining, at the network routing device, a second threshold packet drop rate based on the second average packet drop rate;
assigning, at the network routing device, a lower priority status to packets of the packet flows of the select aggregation at a second time in response to determining a current packet drop rate of the select aggregation at the second time is greater than the second threshold packet drop rate, the second time subsequent to the first time; and
preferentially selecting for transmission by the network routing device packets having the higher priority status over packets having the lower priority status.
18. The method of claim 17 , wherein:
determining the first current packet drop rate for the select aggregation comprises determining the first current packet drop rate based on a comparison of a first accumulated data size of packets for the packet flows of the select aggregation received by the network routing device up to the first time to a first accumulated data size of packets for packet flows of the select aggregation output by the network routing device up to the first time; and
determining the second current packet drop rate for the select aggregation comprises determining the second current packet drop rate based on a comparison of a second accumulated data size of packets for the packet flows of the select aggregation received by the network routing device up to the second time to a second accumulated data size of packets for packet flows of the select aggregation output by the network routing device up to the second time.
19. The method of claim 17 , wherein:
determining the first threshold packet drop rate comprises one of setting the first threshold packet drop rate to the greater of the first average packet drop rate and a predetermined minimum packet drop rate; and
determining the second threshold packet drop rate comprises one of setting the second threshold packet drop rate to the greater of the second average packet drop rate and the predetermined minimum packet drop rate.
20. The method of claim 17 , wherein preferentially selecting for transmission packets having the higher priority status over packets having the lower priority status comprises preferentially selecting packets in accordance with at least one of an Active Queue Management policy or a Weighted Random Early Detection policy.