Management of cellular data usage during denial of service (DoS) attacks

1. A method comprising:

detecting, by a network security device of a private network, a denial of service (DoS) attack in network traffic observed by the network security device;

determining, by the network security device, whether the DoS attack is being transmitted through a cellular modem associated with a cellular data network; and

responsive to said determining being affirmative, mitigating adverse affects of the DoS attack, including, managing cellular network data usage while the private network is experiencing the DoS attack by reducing, by the network security device, data usage of the cellular modem by: setting, by the network security device, a traffic flow template (TFT) on the cellular modem by sending, by the network security device, a control command to the cellular modem to reduce its usage of the cellular data network, wherein the TFT is used for routing of downlink packets onto different quality of service (QoS) flows towards the cellular modem or sending, by the network security device, a control command to a command server of the cellular data network to reduce data usage of the cellular data network, including: encoding, by the network security device, information regarding the DoS attack within the control command to the command server; and sending, by the network security device, the information regarding the DoS attack to the command server of the cellular data network, wherein the information regarding the DoS attack is decoded by the command server and network traffic deemed to be associated with the DoS attack based on the information regarding the DoS attack is blocked or at least reduced by the cellular data network.

2. The method of claim 1 , further comprising authenticating, by the network security device, with the command server of the cellular data network before sending the control command to the command server.

3. The method of claim 1 , wherein the control command is sent by the cellular modem through a short message service (SMS) message to the command server of the cellular data network.

4. The method of claim 3 , further comprising: detecting, by the network security device, whether the private network has lost its network connection with the cellular data network; and when a result of said detecting is affirmative, then sending the control command through the SMS message.

5. The method of claim 1 , further comprising restoring, by the network security device, the data usage of the cellular modem when the DoS attack is determined to be over.

6. A network security device comprising:

a non-transitory storage device having embodied therein instructions representing a security application; and one or more processors coupled to the non-transitory storage device and operable to execute the security application to perform a method comprising:

detecting a denial of service (DoS) attack in network traffic of a private network protected by the network security device;

determining whether the DoS attack is being transmitted through a cellular modem associated with a cellular data network used by the private network; and

responsive to said determining being affirmative, mitigating adverse affects of the DoS attack, including, managing cellular network data usage while the private network is experiencing the DoS attack by reducing data usage of the cellular modem by:

setting, by the network security device, a traffic flow template (TFT) on the cellular modem by sending, by the network security device, a control command to the cellular modem to reduce its usage of the cellular data network, wherein the TFT is used for routing of downlink packets onto different Quality of service (QoS) flows towards the cellular modem; or sending, by the network security device, a control command to a command server of the cellular data network to reduce data usage of the cellular data network, including: encoding, by the network security device, information regarding the DoS attack within the control command to the command server; and sending, by the network security device, the information regarding the DoS attack to the command server of the cellular data network, wherein the information regarding the DoS attack is decoded by the command server and network traffic deemed to be associated with the DoS attack based on the information regarding the DoS attack is blocked or at least reduced by the cellular data network.

7. The network security device of claim 6 , wherein the method further comprises authenticating with the command server of the cellular data network before sending the control command to the command server.

8. The network security device of claim 6 , wherein the control command is sent by the cellular modem through a short message service (SMS) message to the command server of the cellular data network.

9. The network security device of claim 8 , wherein the method further comprises: detecting whether the private network has lost its network connection with the cellular data network; and when a result of said detecting is affirmative, then sending the control command through the SMS message.

10. The network security device of claim 6 , wherein the method further comprises restoring the data usage of the cellular modem when the DoS attack is determined to be over.

11. The method of claim 1 , wherein the control command to the cellular modem comprises an AT command.

12. The method of claim 11 , wherein the AT command comprises AT+CGTFT.

13. The method of claim 1 , wherein the information regarding the DoS attack comprises an attack signature of the DoS attack.

14. The network security device of claim 6 , wherein the control command to the cellular modem comprises an AT command.

15. The network security device of claim 14 , wherein the AT command comprises AT+CGTFT.

16. The network security device of claim 6 , wherein the information regarding the DoS attack comprises an attack signature of the DoS attack.