Event driven route control
Embodiments provide system and methods for a DDoS service using a mix of mitigation systems (also called scrubbing centers) and non-mitigation systems. The non-mitigation systems are less expensive and thus can be placed at or near a customer's network resource (e.g., a computer, cluster of computers, or entire network). Under normal conditions, traffic for a customer's resource can go through a mitigation system or a non-mitigation system. When an attack is detected, traffic that would have otherwise gone through a non-mitigation system is re-routed to a mitigation system. Thus, the non-mitigation systems can be used to reduce latency and provide more efficient access to the customer's network resource during normal conditions. Since the non-mitigation servers are not equipped to respond to an attack, the non-mitigation systems are not used during an attack, thereby still providing protection to the customer network resource using the mitigation systems.
1. A method comprising:
detecting an attack event;
determining a routing scheme that routes network traffic to one or more mitigation systems of a mitigation network;
communicating the routing scheme to one or more routing devices to cause the one or more routing devices to update from a first Domain Name Service (DNS) zone associated with a non-mitigation system of the mitigation network to a second DNS zone associated with the one or more mitigation systems; and
initiating, by the one or more mitigation systems, scrubbing of the network traffic according to one or more mitigation rules.
2. The method as recited in claim 1 , further comprising:
detecting an end of the attack event; and
communicating another routing scheme corresponding to the non-mitigation system to the one or more routing devices.
3. The method as recited in claim 1 , wherein a distributed system of devices determines the routing scheme based on signaling from a central server.
4. The method as recited in claim 3 , wherein a plurality of possible routing schemes are predetermined before the attack event is detected.
5. The method as recited in claim 1 , wherein a central server of the mitigation network determines the routing scheme.
6. The method as recited in claim 1 , wherein the customer network resource is a customer network or a computer hosting a website of the customer.
7. The method as recited in claim 1 , wherein the attack event is a distributed denial of service attack.
8. A mitigation network comprising:
at least one processor;
memory, operatively connected to the at least one processor and storing instructions that, when executed by the at least one processor, cause the at least one processor to perform a method, the method comprising:
detecting an attack event;
determining a routing scheme that routes network traffic to one or more mitigation systems of the mitigation network;
communicating the routing scheme to one or more routing devices to cause the one or more routing devices to update from a first Domain Name Service (DNS) zone associated with a non-mitigation system of the mitigation network to a second DNS zone associated with the one or more mitigation systems; and
causing the one or more mitigation systems to initiate scrubbing of the network traffic according to one or more mitigation rules.
9. The mitigation network as recited in claim 8 , the method further comprising:
detecting an end of the attack event; and
communicating another routing scheme corresponding to the non-mitigation system to the one or more routing devices.
10. The mitigation network as recited in claim 8 , wherein a distributed system of devices determines the routing scheme based on signaling from a central server.
11. The mitigation network as recited in claim 10 , wherein a plurality of possible routing schemes are predetermined before the attack event is detected.
12. The mitigation network as recited in claim 8 , wherein a central server of the mitigation network determines the routing scheme.
13. The mitigation network as recited in claim 8 , wherein the customer network resource is a customer network or a computer hosting a website of the customer.
14. The mitigation network as recited in claim 8 , wherein the attack event is a distributed denial of service attack.
15. Non-transitory computer readable media comprising instructions that, when executed by one or more processors associated with a mitigation network comprising one or more mitigation systems, cause the one or more processors to:
detecting an attack event;
determining a routing scheme that routes network traffic to one or more mitigation systems of a mitigation network;
communicating the routing scheme to one or more routing devices to cause the one or more routing devices to update from a first Domain Name Service (DNS) zone associated with a non-mitigation system of the mitigation network to a second DNS zone associated with the one or more mitigation systems; and
causing the one or more mitigation systems to initiate scrubbing of the network traffic according to one or more mitigation rules.
16. The non-transitory computer readable media as recited in claim 15 , wherein the instructions further cause the one or more processors to:
detect an end of the attack event; and
communicate another routing scheme corresponding to the non-mitigation system to the one or more routing devices.
17. The non-transitory computer readable media as recited in claim 15 , wherein the instructions further cause the one or more processors to determine the routing scheme based on signaling from a central server.