Granted Patent B2

US 7,487,541 · App. 10/730,926 · Granted Feb 3, 2009

Abstract

Claims (36)

1. A method of tracking-back a single malicious data packet in a connection-oriented communication network including a network node comprising a plurality of router interfaces, the method comprising the steps of:

a) for a given time window of a predetermined length, computing a flow identifier that uniquely identifies a given flow seen by a respective router interface at said network node;

b) inserting said flow identifier into a data structure storing flow identifiers computed at said respective router interface during said time window;

c) storing said data structure in a searchable repository at said network node;

d) repeating steps a) to c) for a plurality of successive time windows, wherein each router interface stores a separate data structure for each time window;

e) determining an arrival time window including a time of arrival of said single malicious packet at said network node, and computing a flow identifier for said single malicious packet; and

f) identifying said router interface for said single malicious packet by searching for the flow identifier of said single malicious packet in all data structures stored at said network node that contain data for said arrival time window.

2. The method of claim 1 , further comprising tracing-back hop by hop the source of said single packet from said router, by performing steps e) and f) for each network node along the path of said single malicious packet.

3. The method of claim 1 , wherein step a) is based on a flow definition adopted for said network.

4. The method of claim 1 , wherein step a) comprises applying a specified function to one or more header fields of each packet received in said flow.

5. The method of claim 1 , wherein step a) comprises applying a specified function to one or more header fields of each packet received in said flow and an incoming interface identification parameter.

6. The method of claim 1 , wherein step a) comprises applying a specified function to one or more characteristics of each packet.

7. The method of claim 1 , wherein step a) comprises applying a specified function to one or more characteristics of each packet received in said flow and an incoming interface identification parameter.

8. The method of claim 1 , wherein said data structure is a hash table based on a Bloom filter.

9. The method of claim 1 , wherein said searchable repository is maintained for each router interface at said network node.

10. The method of claim 9 , wherein said searchable repository stores all said data structures for all router interfaces at said network node.

11. The method of claim 1 , wherein said searchable database is a centralized searchable repository maintained for said network.

12. A method of tracking-back a single malicious data packet in a connection-oriented communication network including a network node comprising a plurality of router interfaces, the method comprising the steps of:

a) for a given time window of a predetermined length, computing a flow identifier that uniquely identifies a given flow seen by a respective router interface at said network node based on a flow characterization parameter obtained from a flow management system;

b) inserting said flow identifier into a data structure storing flow identifiers computed at said respective router interface during said time window;

c) storing said data structure in a database that is a centralized searchable repository;

d) repeating steps a) to c) for a plurality of successive time windows, wherein each router interface stores a separate data structure for each time window; and

e) finding, in said searchable repository, the router interface for said single malicious packet by searching for a corresponding flow identifier in all data structures containing data for an arrival time window, wherein the arrival time window includes a time of arrival of said single malicious packet.

13. A system for tracking-back a single malicious data packet in a connection-oriented communication, comprising:

means for computing a flow identifier that uniquely identifies a given flow seen by a router interface at a network node during a given time window of a predetermined length;

means for inserting said flow identifier into a data structure storing flow identifiers computed at said router interface during said time window;

a database that is a centralized searchable repository for storing said data structure; and

a search engine for finding, in said searchable repository, the router interface for said single malicious packet by searching for a corresponding flow identifier in all data structures containing data for an arrival time window wherein die arrival time window includes a time of arrival of said since malicious packet.

14. The system of claim 13 further comprising a flow-based monitoring system for tracking back hop-by-hop the source of said single malicious packet.

15. The system of claim 13 , wherein a searchable repository is maintained for each interface at said network node.

16. The system of claim 13 , wherein a searchable repository is maintained for said network node.

17. The system of claim 13 , wherein said searchable repository is a centralized database maintained for said network.

18. The system of claim 13 , further comprising a flow based monitoring system for providing a flow characterization parameter to said means for calculating.

19. The system of claim 13 further comprising a flow management system for generating a flow characterization parameter.

20. The system of claim 19 , wherein said means for computing is a flow identifier calculator for computing said flow identifier from at least one of packet header fields, packet characterization parameters, and interface identification information.

21. The system of claim 19 , wherein said means for computing is a flow identifier calculator for computing said flow identifier from packet header information.

Assignments (14)