Session maturity model with trusted sources
Aspects of the present disclosure disclose provide systems and methods for performing session maturity modeling and tracking to aid in the identification of network traffic that should and/or should not be subjected to DOS mitigation mechanisms. More specifically, based on a maturity status of identification information associated with a communication, a communication may bypass high traffic mitigation mechanisms such as packet rate and connection rate limitations.
1. A system comprising:
at least one processor; and
at least one memory including instructions which when executed by the at least one processor, causes the at least one processor to:
assign a first maturity status to a first communication between a first communication device and a second communication device by associating the first maturity status with identification information from the first communication, wherein the associating comprises determining whether the identification information is included in a table corresponding to the first maturity status;
apply a traffic rate mitigation technique or a traffic analysis technique to the first communication when the identification information is included in the table corresponding to the first maturity status, wherein the traffic rate mitigation technique or the traffic analysis technique includes dropping the first communication; and
assign a second maturity status to a second communication between the first communication device and the second communication device by associating the second maturity status with the identification information, wherein the traffic rate mitigation technique or the traffic analysis technique is not applied to the second communication based on the second maturity status.
2. The system of claim 1 , wherein the identification information includes at least one of an IP address of the first communication device, a protocol of the first communication, or a portion associated with the first communication.
3. The system of claim 2 , wherein the instructions cause the processor to drop the first communication if the identification information is included in the table corresponding to the first maturity status.
4. The system of claim 2 , wherein the protocol of the first communication includes at least one of transmission control protocol or user datagram protocol.
5. The system of claim 1 , wherein the first communication is received at a third device communicatively coupling the first communication device to the second communication device.
6. The system of claim 1 , wherein the second communication is classified as a mature communication based on a quantity of communications having occurred between the first communication device and the second communication device.
7. The system of claim 5 , wherein the second communication is assigned the second maturity status based on a quantity of communications having occurred within a threshold period of time.
8. The system of claim 1 , wherein the first communication is received from the first communication device located external to the second communication device.
9. The system of claim 1 , wherein the table is a known good table comprising communication information that is associated with a trusted device.
10. A method comprising:
assigning a first maturity status to a first communication between a first communication device and a second communication device by associating the first maturity status with identification information from the first communication, wherein the associating comprises determining whether the identification information is included in a table corresponding to the first maturity status;
applying a traffic rate mitigation technique or a traffic analysis technique to the first communication when the identification information is included in the table corresponding to the first maturity status, wherein the traffic rate mitigation technique or the traffic analysis technique includes dropping the first communication; and
assigning a second maturity status to a second communication between the first communication device and the second communication device by associating the second maturity status with the identification information, wherein the traffic rate mitigation technique or the traffic analysis technique is not applied to the second communication based on the second maturity status.
11. The method of claim 10 , wherein if the identification information is included in the table corresponding to the first maturity status, removing the identification information from the table and modifying a second table corresponding to the second maturity status to include the identification information.
12. The method of claim 10 , further comprising assigning the second maturity status the second communication based on a quantity of communications having occurred between the first communication device and the second communication device within a threshold period of time.
13. A device comprising:
at least one processor; and
at least one memory including instructions which when executed by the at least one processor, causes the at least one processor to:
assign a first maturity status to a first communication received from a first communication device by associating the first maturity status with identification information from the first communication, wherein the associating comprises determining whether the identification information is included in a table corresponding to the first maturity status;
apply a traffic rate mitigation technique or a traffic analysis technique to the first communication when the identification information is included in the table corresponding to the first maturity status, wherein the traffic rate mitigation technique or the traffic analysis technique includes dropping the first communication; and
assign a second maturity status to a second communication between the first communication device and a second communication device by associating the second maturity status with the identification information, wherein the traffic rate mitigation technique or the traffic analysis technique is not applied to the second communication based on the second maturity status.
14. The device of claim 13 , wherein the instructions cause the processor to send a third communication to the communication device, the third communication being sent after the first communication.
15. The device of claim 14 , wherein the identification information includes at least one of an IP address of the communication device, a protocol of the first communication, or a port associated with the first communication.
16. The device of claim 13 , wherein the second communication is assigned the second maturity status based on a quantity of communications received from the communication device.
17. The method of claim 10 , wherein the table is a known good IP table comprising one or more IP addresses that are associated with a trusted device.
18. The device of claim 13 , wherein the table is a known good table comprising communication information that is associated with a known device.