Systems, methods, and devices for defending a network
Certain exemplary embodiments comprise a method comprising: within a backbone network: for backbone network traffic addressed to a particular target and comprising attack traffic and non-attack traffic, the attack traffic simultaneously carried by the backbone network with the non-attack traffic: redirecting at least a portion of the attack traffic to a scrubbing complex; and allowing at least a portion of the non-attack traffic to continue to the particular target without redirection to the scrubbing complex.
1. A method for defending a network, comprising: providing an alert to a route controller if more than a configurable amount of backbone network traffic comprises distributed denial of service traffic, wherein the alert is provided by utilizing instructions stored in memory and executed by a processor, wherein the backbone network traffic is addressed to a target; transmitting a portion of non-distributed denial of service traffic of the backbone traffic to the target without redirection to a scrubbing complex; redirecting a portion of the distributed denial of service traffic to the scrubbing complex to be scrubbed; transmitting scrubbed distributed denial of service traffic from the scrubbing complex to the target via a tunnel that prevents the scrubbed distributed denial of service traffic from being looped repeatedly through the scrubbing complex; and ranking a plurality of sources that are transmitting the distributed denial of service traffic to the target, wherein the sources are ranked at least in part based on an amount of traffic contributed by each source of the plurality of sources; providing feedback to the route controller, wherein the route controller adjusts the portion of the distributed denial of service traffic that is redirected to the scrubbing complex based on the feedback.
2. The method of claim 1 , wherein the route controller advertises a route to a backbone network ingress point via internal border gateway protocol.
3. The method of claim 1 , wherein the route controller advertises automated dynamic control of the portion of the distributed denial of service traffic redirected to the scrubbing complex.
4. The method of claim 1 , further comprising monitoring the backbone network traffic for the distributed denial of service traffic.
5. The method of claim 1 , further comprising determining that the portion of the distributed denial of service traffic redirected to the scrubbing complex no longer needs to be scrubbed.
6. The method of claim 1 , further comprising reporting statistics associated with the amount of traffic contributed by each source of the plurality of sources to the route controller.
7. The method of claim 1 , further comprising determining a source identifier for the portion of the distributed denial of service traffic.
8. The method of claim 1 , further comprising determining an identity of a source of the plurality of sources contributing to the backbone network traffic addressed to the target.
9. The method of claim 1 , further comprising inserting a route to the scrubbing complex, wherein the route comprises a first prefix that is longer than a second prefix originally associated with the portion of the distributed denial of service traffic.
10. The method of claim 1 , further comprising treating any backbone network traffic from a source of the plurality of sources that contributes less than a predetermined amount of the distributed denial of service traffic during a predetermined time period as the non-distributed denial of service traffic.
11. A system for defending a network, comprising: a memory that stores instructions; a processor that executes the instructions to perform operations comprising: providing an alert to a route controller if more than a configurable amount of backbone network traffic comprises distributed denial of service traffic, wherein the backbone network traffic is addressed to a target; transmitting a portion of non-distributed denial of service traffic of the backbone traffic to the target without redirection to a scrubbing complex; redirecting a portion of the distributed denial of service traffic to the scrubbing complex to be scrubbed; transmitting scrubbed distributed denial of service traffic from the scrubbing complex to the target via a tunnel that prevents the scrubbed distributed denial of service traffic from being looped repeatedly through the scrubbing complex; and ranking a plurality of sources that are transmitting the distributed denial of service traffic to the target, wherein the sources are ranked at least in part based on an amount of traffic contributed by each source of the plurality of sources; providing feedback to the route controller, wherein the route controller adjusts the portion of the distributed denial of service traffic that is redirected to the scrubbing complex based on the feedback.
12. The system of claim 11 , wherein the operations further comprise monitoring the backbone network traffic for the distributed denial of service traffic.
13. The system of claim 11 , wherein the operations further comprise reporting statistics associated with the amount of traffic contributed by each source of the plurality of sources to the route controller.
14. The system of claim 11 , wherein the operations further comprise determining an identity of a source of the plurality of sources contributing to the backbone network traffic addressed to the target.
15. The system of claim 11 , wherein the operations further comprise treating any backbone network traffic from a source of the plurality of sources that contributes less than a predetermined amount of the distributed denial of service traffic during a predetermined time period as the non-distributed denial of service traffic.
16. The system of claim 11 , wherein the operations further comprise determining that the portion of the distributed denial of service traffic redirected to the scrubbing complex no longer needs to be scrubbed.
17. The system of claim 11 , wherein the route controller advertises automated dynamic control of the portion of the distributed denial of service traffic redirected to the scrubbing complex.
18. A tangible computer-readable medium comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations comprising: providing an alert to a route controller if more than a configurable amount of backbone network traffic comprises distributed denial of service traffic, wherein the backbone network traffic is addressed to a target; transmitting a portion of non-distributed denial of service traffic of the backbone traffic to the target without redirection to a scrubbing complex; redirecting a portion of the distributed denial of service traffic to the scrubbing complex to be scrubbed; transmitting scrubbed distributed denial of service traffic from the scrubbing complex to the target via a tunnel that prevents the scrubbed distributed denial of service traffic from being looped repeatedly through the scrubbing complex; and ranking a plurality of sources that are transmitting the distributed denial of service traffic to the target, wherein the sources are ranked at least in part based on an amount of traffic contributed by each source of the plurality of sources; providing feedback to the route controller, wherein the route controller adjusts the portion of the distributed denial of service traffic that is redirected to the scrubbing complex based on the feedback.