Local DDOS mitigation announcements in a telecommunications network

1. A method for mitigating network threats, the method comprising:

determining a service level agreement between a customer network and a telecommunications network;

configuring a provider edge device of the telecommunications network to accept distributed denial of service mitigation rule propagation from a customer edge device of the customer network in communication with the provider edge device;

receiving a distributed denial of service mitigation rule for the customer network at the provider edge device from the customer edge device, the distributed denial of service mitigation rule including one or more routing parameters and a mitigation action;

determining whether the denial of service mitigation rule is permitted to be implemented on the provider edge device according to the service level agreement;

implementing, when the denial of service mitigation rule is permitted according to the service level agreement between the customer network and the telecommunications network, the distributed denial of service mitigation rule, locally on the provider edge device of the telecommunications network, to apply to network traffic being sent to the provider edge device and destined for the customer edge device; and

preventing a broadcasting of the distributed denial of service mitigation rule in the telecommunications network beyond the provider edge device.

2. The method of claim 1 , wherein configuration of the provider edge device to accept distributed denial of service mitigation rule propagation includes storing at least one known Internet Protocol address associated with the customer network.

3. The method of claim 2 , wherein the one or more routing parameters includes the at least one known Internet Protocol address as a destination Internet Protocol address routing parameter.

4. The method of claim 3 , further comprising:

receiving a communications packet of a potential distributed denial of service attack at the provider edge device, the communications packet including a destination Internet Protocol address matching the destination Internet Protocol address routing parameter; and

executing the mitigation action of the communications packet at the provider edge device.

5. The method of claim 1 , wherein configuration of the provider edge device to accept distributed denial of service mitigation rule propagation includes establishing a Border Gateway Protocol session between the customer edge device and the provider edge device.

6. The method of claim 1 , wherein configuration of the provider edge device to accept distributed denial of service mitigation rule propagation includes applying a service level agreement parameter to the provider edge device for validating a distributed denial of service mitigation rule type for the customer network.

7. The method of claim 1 , wherein the distributed denial of service mitigation rule is validated prior to implementation.

8. The method of claim 7 , wherein validating the distributed denial of service mitigation rule includes at least one of: comparing a destination Internet Protocol address of the routing parameter to a known Internet Protocol address of the customer network; or determining whether the distributed denial of service mitigation rule is within a service level agreement between the customer network and the telecommunications network.

9. The method of claim 1 , wherein the one or more routing parameters includes at least one of: a destination Internet Protocol address of a targeted device of the customer network; a source Internet Protocol address within a detected range; a source port, a destination port, a communication protocol, or a parameter defining a communications packet of a distributed denial of service attack.

10. The method of claim 1 , wherein the mitigation action includes at least one of: rerouting a communications packet matching the one or more routing parameters to a scrubbing device of the customer network; dropping a communications packet matching the one or more routing parameters; or rate throttling a communications packet matching the one or more routing parameters.

11. The method of claim 1 , wherein the distributed denial of service mitigation rule is received and implemented automatically in response to a detected distributed denial of service attack associated with the customer network.

12. The method of claim 1 , wherein implementation of the distributed denial of service mitigation rule locally on the provider edge device includes limiting implementation of the distributed denial of service mitigation rule to traffic transmitted through an interface of the provider edge device associated with the customer network.

13. The method of claim 1 , further comprising:

receiving a communications packet for routing to the customer network at the provider edge device, the communications packet including routing information;

comparing the routing information of the communications packet to the one or more routing parameters of the distributed denial of service mitigation rule; and

executing the mitigation action when the routing information of the communications packet matches the one or more routing parameters of the distributed denial of service mitigation rule.

14. The method of claim 1 , wherein the distributed denial of service mitigation rule is removed from the provider edge device in response to a removal request from the customer network.

15. The method of claim 14 , wherein the removal request includes removal instructions received at the provider edge device from the customer edge device.

16. The method of claim 14 , wherein the removal request includes a termination of a Border Gateway Protocol session between the customer edge device and the provider edge device.

17. One or more non-transitory tangible computer-readable storage media storing computer-executable instructions for performing a computer process on a computing system, the computer process comprising:

determining a service level agreement between a first telecommunications network and a second telecommunications network;

configuring a first edge device of the first telecommunications network to accept distributed denial of service mitigation rule propagation from a second edge device of the second telecommunications network in communication with the first edge device;

receiving a distributed denial of service mitigation rule for the second telecommunications network at the first edge device from the second edge device, the distributed denial of service mitigation rule including one or more routing parameters and a mitigation action;

determining whether the denial of service mitigation rule is permitted to be implemented on the first edge device according to the service level agreement;

implementing, when the denial of service mitigation rule is permitted according to the service level agreement between the first telecommunications network and the second telecommunications network, the distributed denial of service mitigation rule locally on the first edge device of the first telecommunications network, to apply to network traffic being sent to the first edge device and destined for the second edge device; and

preventing a broadcasting of the distributed denial of service mitigation rule in the first telecommunications network beyond the first edge device.

18. The one or more non-transitory tangible computer-readable storage media of claim 17 , further comprising:

receiving a communications packet for routing to the second telecommunications network at the first edge device, the communications packet including routing information; comparing the routing information of the communications packet to the one or morerouting parameters of the distributed denial of service mitigation rule; and

executing the mitigation action when the routing information of the communications packet matches the one or more routing parameters of the distributed denial of service mitigationrule.

19. A system for mitigating network threats, the system comprising:

a customer edge device deployed in a customer network;

a distributed denial of service mitigator in communication with the customer edge device, the distributed denial of service mitigator broadcasting a distributed denial of service mitigation rule to the customer edge device in response to a distributed denial of service attack detected for targeting the customer network; and

a provider edge device deployed in a telecommunications network and in communication with the customer edge device, the provider edge device configured to accept distributed denial of service mitigation propagation from the customer edge device, the provider edge device receiving the distributed denial of service mitigation rule from the customer edge device, determining whether the denial of service mitigation rule is permitted to be implemented on the provider edge device according to a service level agreement, and implementing, when the denial of service mitigation rule is permitted according to the service level agreement between the customer network and the telecommunications network, the distributed denial of service mitigation rule, locally on the provider edge device, to apply to network traffic being sent to the provider edge device and destined for the customer edge device, the distributed denial of service mitigation rule is prevented from being broadcasted in the telecommunications network beyond the provider edge device.

20. The system of claim 19 , wherein the provider edge device receives and implements the distributed denial of service mitigation rule automatically.