DDoS detection using sensor grid
Methods and apparatus for detecting a network attack are disclosed. A sensor grid may be established in a network (e.g., an enterprise network). The sensors may monitor network assets across various network layers and transmit to a server signals that indicate the probability of an attack on the network. The server may apply an amplification algorithm to combine and amplify all of the received signals into a single signal that more accurately displays the probability of an attack on the network.
1. A computer-implemented method, comprising:
receiving, at a server, a plurality of signals from a sensor grid comprising a plurality of sensors that monitor network information, wherein individual sensors of the plurality of sensors are associated with individual assets of a network, and wherein the signals indicate a probability of a network attack;
storing the signals at the server;
combining and amplifying, at the server, each of the plurality of signals to produce a single amplified signal;
detecting, at the server, whether a network attack is occurring based, at least in part, on whether the single amplified signal indicates an increased intensity; and
outputting, at the server, a response if a network attack is occurring.
2. The method of claim 1 , wherein the combining further comprises amplifying the plurality of signals according to an amplification algorithm.
3. The method of claim 1 , wherein the plurality of signals indicate a probability of a network attack at a plurality of network layers.
4. The method of claim 1 , wherein the network attack is a distributed denial of service (DDoS) attack.
5. The method of claim 1 , wherein the single amplified signal provides a single indicator of a probability of attack across all network layers in a network.
6. The method of claim 2 , wherein the amplification algorithm comprises a multiplication of probabilities that an attack is not occurring.
7. The method of claim 1 , wherein the response comprises one or more of the following: blocking the source of the network attack and diverting network traffic to a black hole.
8. A non-transitory computer-readable storage medium having computer-executable program instructions stored thereon that, when executed by a processor, cause the processor to:
receive, at a server, a plurality of signals from a sensor grid comprising a plurality of sensors that monitor network information, wherein individual sensors of the plurality of sensors are associated with individual assets of a network, and wherein the signals indicate a probability of a network attack;
store the signals at the server;
combine and amplify, at the server, each of the plurality of signals to produce a single amplified signal;
detect, at the server, whether a network attack is occurring based, at least in part, on whether the single amplified signal indicates an increased intensity; and
output, at the server, a response if a network attack is occurring.
9. The non-transitory computer-readable storage medium of claim 8 , wherein the instructions to combine further cause the processor to amplify the plurality of signals according to an amplification algorithm.
10. The transitory computer-readable storage medium of claim 8 , wherein the plurality of signals indicate a probability of a network attack at a plurality of network layers.
11. The transitory computer-readable storage medium of claim 8 , wherein the network attack is a distributed denial of service (DDoS) attack.
12. The transitory computer-readable storage medium of claim 8 , wherein the single amplified signal provides a single indicator of a probability of attack across all network layers in a network.
13. The transitory computer-readable storage medium of claim 9 , wherein the amplification algorithm comprises a multiplication of probabilities that an attack is not occurring.
14. The transitory computer-readable storage medium of claim 8 , wherein the response comprises one or more of the following: blocking the source of the network attack and diverting network traffic to a black hole.
15. An apparatus comprising:
a memory;
a processor, wherein the processor executes computer-executable program instructions which cause the processor to:
receive a plurality of signals from a sensor grid comprising a plurality of sensors that monitor network information, wherein individual sensors of the plurality of sensors are associated with individual assets of a network, and wherein the signals indicate a probability of a network attack;
store the signals at the memory;
combine and amplify of the plurality of signals to produce a single amplified signal;
detect whether a network attack is occurring based, at least in part, on whether the single amplified signal indicates an increased intensity; and
output a response if a network attack is occurring.
16. The apparatus of claim 15 , wherein the instructions to combine further cause the processor to amplify the plurality of signals according to an amplification algorithm.
17. The apparatus of claim 15 , wherein the plurality of signals indicate a probability of a network attack at a plurality of network layers.
18. The apparatus of claim 15 , wherein the network attack is a distributed denial of service (DDoS) attack.
19. The apparatus of claim 15 , wherein the signal amplified signal provides a single indicator of a probability of attack across all network layers in a network.
20. The apparatus of claim 15 , wherein the response comprises one or more of the following: blocking the source of the network attack and diverting network traffic to a black hole.