System and method for avoiding and mitigating a DDoS attack
Described is a system and method for receiving a data packet including a destination address and a source address, the data packet corresponding to a port number, assigning an address risk value for the data packet based on the source address and a port risk value for the data packet based on the port number. The data packet is categorized into a community based on the source address, wherein the community is predefined by a user corresponding to the destination address, the community includes a utility value. The address risk value and the port risk value are compared to the utility value to yield a benefit coefficient and the data packet is treated based on the benefit coefficient.
1. A method, comprising:
receiving a data packet including a destination address and a source address;
performing a first longest prefix match on the destination address;
determining a utility value based on one of the destination address and a result of the first longest prefix match;
if a result of the first longest prefix match is an entry of a per customer table, performing a second longest prefix match on the source address;
determining an address risk value based on one of the source address and a result of the second longest prefix match;
comparing the address risk value and the utility value to yield a benefit coefficient; and
selecting a treatment for the data packet based on the benefit coefficient.
2. The method of claim 1 , wherein the first longest prefix match corresponds to an algorithm to select an entry from a routing table.
3. The method of claim 2 , wherein the algorithm is performed by a network router.
4. The method of claim 2 , wherein the algorithm includes comparing the destination address to a plurality of customer addresses.
5. The method of claim 4 , wherein the customer addresses include IP addresses.
6. The method of claim 1 , wherein, if the result of the first longest prefix match is a next-hop address, routing the data packet according to a normal routing operation.
7. The method of claim 6 , wherein the next-hop address is an IP address of an adjacent router to which the data packet is to be sent.
8. The method of claim 1 , wherein the treatment includes one of:
dropping traffic from the source address,
limiting traffic from the source address, and
marking traffic from the source address.
9. The method of claim 8 , wherein the dropping traffic from the source address includes terminating the traffic from the source address at a single provider edge router.
10. A router, comprising:
a memory;
a network interface;
a receiving module receiving a data packet including a destination address and a source address;
a first performing module performing a first longest prefix match on the destination address;
a first determining module determining a utility value based on one of the destination address and a result of the first longest prefix match;
a second performing module performing, if a result of the first longest prefix match is an entry of a per customer table, a second longest prefix match on the source address;
a second determining module determining an address risk value based on one of the source address and a result of the second longest prefix match;
a comparing module comparing the address risk value and the utility value to yield a benefit coefficient; and
a selecting module selecting a treatment for the data packet based on the benefit coefficient.
11. The router of claim 10 , wherein the first longest prefix match corresponds to an algorithm to select an entry from a routing table.
12. The router of claim 11 , wherein the algorithm is performed by a network router.
13. The router of claim 11 , wherein the algorithm includes comparing the destination address to a plurality of customer addresses.
14. The router of claim 11 , wherein the customer addresses include IP addresses.
15. The router of claim 10 , wherein, if the result of the first longest prefix match is a next-hop address, routing the data packet according to a normal routing operation.
16. The router of claim 15 , wherein the next-hop address is an IP address of an adjacent router to which the data packet is to be sent.
17. The router of claim 10 , wherein the treatment includes one of:
dropping traffic from the source address,
limiting traffic from the source address, and
marking traffic from the source address.
18. The router of claim 17 , wherein the dropping traffic from the source address includes terminating the traffic from the source address at a single provider edge router.
19. A computer readable storage medium including a set of instructions executable by a processor, the set of instructions operable to:
receive a data packet including a destination address and a source address;
perform a first longest prefix match on the destination address;
determine a utility value based on one of the destination address and a result of the first longest prefix match;
if a result of the first longest prefix match is an entry of a per customer table, perform a second longest prefix match on the source address;
determine an address risk value based on one of the source address and a result of the second longest prefix match;
compare the address risk value and the utility value to yield a benefit coefficient; and
select a treatment for the data packet based on the benefit coefficient.