IP Library Granted Patent US 9,294,503
Granted Patent B2
US 9,294,503 · App. 14/010,221 · Granted Mar 22, 2016

Health monitor based distributed denial of service attack mitigation

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,294,503
App. No.
14/010,221
Granted
Mar 22, 2016
Kind
B2
Abstract

Provided are methods and systems for mitigating a DDoS event. The method may comprise receiving an indication of a collapse of a collapsible virtual data circuit associated with network data traffic. In response to the received indication of the collapse, the collapse may be attributed to the DDoS event. Furthermore, the method may comprise redirecting the network data traffic to one or more DDoS mitigation services. The method may further comprise mitigating the DDoS event by the one or more DDoS mitigation services.

Claims (41)

1. A method for mitigating a distributed denial of service (DDoS) event, the method comprising:

sending, by a processor, a request to a health monitor regarding a state of a remote network resource, the health monitor associated with a collapsible virtual data circuit that normally conveys network data traffic and collapses in response to a DDoS event by stopping flow of the network data traffic;

in response to the request, receiving a notification at the processor from the health monitor of an interruption of the network data traffic due to the collapse of the collapsible virtual data circuit;

in response to the notification, attributing the interruption of the network data traffic due to the collapse of the collapsible virtual data circuit to the DDoS event;

changing a Domain Name System (DNS) name upon receiving the notification of the collapse of the collapsible virtual data circuit;

redirecting the network data traffic to one or more DDoS mitigation services;

sending a request to the health monitor associated with the collapsible virtual data circuit regarding the status of the network data traffic flow; and

in response to the request regarding the status of the network data traffic flow, receiving a notification from the health monitor indicating a presence of the network data traffic in the collapsible virtual data circuit, the notification of the presence of the network data traffic in the collapsible virtual data circuit being attributed to a successful mitigation of the DDoS event.

2. The method of claim 1 , wherein the health monitor is implemented by one or more of the following: software, hardware, signaling, and database query.

3. The method of claim 1 , wherein the one or more DDoS mitigation services analyzes the network data traffic to detect DDoS data packages, and filters the DDoS data packages to provide filtered network data traffic.

4. The method of claim 1 , further comprising:

receiving an indication from the health monitor of reestablishment of the network data traffic through the collapsible virtual data circuit; and

directing the network data traffic back to the collapsible virtual data circuit.

5. The method of claim 4 , wherein the network data traffic includes filtered network data traffic.

6. The method of claim 1 , wherein the receiving of the notification of the collapse of the collapsible virtual data circuit is performed via at least one of the following: Ethernet, Internet Protocol (IP), and software defined network (SDN).

7. A system for mitigating a DDoS event, the system comprising a processor that:

sends a request to a health monitor regarding a state of a remote network resource, the health monitor associated with a collapsible virtual data circuit that normally conveys network data traffic and collapses in response to a DDoS event by stopping flow of the network data traffic;

in response to the request, receives a notification at the processor from the health monitor of an interruption of the network data traffic due to the collapse of the collapsible virtual data circuit;

in response to the notification, attributes the interruption of the network data traffic due to the collapse of the collapsible virtual data circuit to the DDoS event;

changes a Domain Name System (DNS) name upon receiving the notification of the collapse of the collapsible virtual data circuit;

redirects the network data traffic to one or more DDoS mitigation services;

sends a request to the health monitor associated with the collapsible virtual data circuit regarding the status of the network data traffic flow; and

in response to the request regarding the status of the network data traffic flow, receives a notification from the health monitor indicating a presence of the network data traffic in the collapsible virtual data circuit, the notification of the presence of the network data traffic in the collapsible virtual data circuit being attributed to a successful mitigation of the DDoS event.

8. The system of claim 7 , wherein the health monitor is implemented by one or more of the following: software, hardware, signaling, and database query.

9. The system of claim 7 , wherein the one or more DDoS mitigation service:

analyzes the network data traffic to detect DDoS data packages; and

filters the DDoS data packages to provide filtered network data traffic.

10. The system of claim 7 , wherein the processor further:

receives an indication from the health monitor of reestablishment of the network data traffic through the collapsible virtual data circuit; and

directs the network data traffic back to the collapsible virtual data circuit.

11. The system of claim 10 , wherein the network data traffic includes filtered network data traffic.

12. The system of claim 7 , wherein the receiving of the notification of the collapse of the collapsible virtual data circuit is performed via at least one of Ethernet, Internet Protocol (IP), and software defined network (SDN).

13. A non-transitory machine-readable medium comprising instructions which, when executed by one or more processors, perform the following operations:

send, by a processor, a request to a health monitor associated with a collapsible virtual data circuit regarding a state of a remote network resource, the collapsible virtual data circuit normally conveying network data traffic and collapsing in response to a DDoS event by stopping flow of the network data traffic;

in response to the request, receive a notification at the processor from the health monitor of an interruption of the network data traffic due to the collapse of the collapsible virtual data circuit;

in response to the notification, attribute the interruption of the network data traffic due to the collapse of the collapsible virtual data circuit to the DDoS event;

change a Domain Name System (DNS) name upon receiving the notification of the collapse of the collapsible virtual data circuit;

redirect the network data traffic to one or more DDoS mitigation services;

send a request to the health monitor associated with the collapsible virtual data circuit regarding the status of the network data traffic flow; and

in response to the request regarding the status of the network data traffic flow, receive a notification from the health monitor indicating a presence of the network data traffic in the collapsible virtual data circuit, the notification of the presence of the network data traffic in the collapsible virtual data circuit being attributed to a successful mitigation of the DDoS event.

14. The method of claim 1 further comprising mitigating, by the one or more DDoS mitigation services, the DDoS event.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Dec 19, 2013
From: THOMPSON, MICHEAL; GROVES, RICH
To: A10 NETWORKS, INC.
Reel/Frame 031819/0373 →
SECURITY INTEREST Recorded Sep 30, 2013
From: A10 NETWORKS, INC.
To: ROYAL BANK OF CANADA, AS COLLATERAL AGENT
Reel/Frame 031485/0284 →