Network self-protection

1. A method used in a network, the method comprising:

monitoring a network state and to collect statistics for flows going through the network;

aggregating flows into clusters and identify flows that can cause a network problem; and

adaptively regulating the identified flow according to network feedback,

wherein the flow aggregation comprises:

defining score S(P)=max(F)−m − (F)=m − (F), where S is the score to measure significance of overloading flows, P is an aggregation rule and a set partition {F 1 , F 2 , . . . , F k }, F is one of F 1 , F 2 , . . . , and F k , and m − is a low median operator;

finding an aggregation rule that reveals an overloading behavior P*=max P S(P), where P* is the aggregation rule that reveals the overloading behavior; and

defining a set of aggregation rules.

2. The method as in claim 1 , wherein the set of aggregation rules are obtained from a past experience or an operator specification.

3. The method as in claim 1 , wherein the set of aggregation rules include at least one of:

ingress or egress for end-to-end flooding,

a source subnet for a compromised virtual machine (VM),

a destination subnet for flash crowd to a specific VM,

a destination port for attack against a specific service,

a list of switches or routers on a path for routing misconfiguration,

a start time range for a correlated data transfer,

a packet arrival frequency threshold for new traffic load,

a duration threshold for a short or failed connection attempt, and

a burstiness threshold for buggy customized Transmission Control Protocol (TCP).

4. The method as in claim 1 ,

wherein at least one of the aggregation rules requires a threshold, and

wherein different threshold values are defined according to different applications.

5. The method as in claim 1 ,

wherein the flow aggregation comprises:

choosing one of the aggregation rules;

clustering flows based on said one of the aggregation rules; and

outputting the set of flows with a highest score or a score exceeding a predetermined threshold value.

6. The method as in claim 1 ,

wherein the flow aggregation comprises:

choosing aggregation rule P in pi*, where pi* is the set of aggregation rules;

for each P′ in the rest of pi*, where P′ is another aggregation rule, adding P″, which is a union of P and P′, into pi*, in case that P and P′ are not mutually refinement of each other and P″ is not in pi* and a score of P″ is larger than a score of P and P′; and

removing P from pi* in case pi* includes an aggregation rule that has a lager score than P.

7. The method as in claim 1 ,

wherein the adaptive regulation comprises:

applying an extra delay to round-trip delay time (RTT) of an overloading flow.

8. The method as in claim 1 , wherein the network comprises an OpenFlow network.

9. The method as in claim 8 , wherein the method is used in a proxy device disposed between a switch and a controller.