Mitigation of denial of service attacks on emergency services
Systems and methods are provided for mitigating denial of service attacks in a communications network. Based on a determination that requests to access an E11 resource exceeds a threshold, it may be determined that a denial of service attack attempt is occurring. One or more mitigation protocols can be used to block, filter, or re-route attempts that are associated with the denial of service attack. Association with the denial of service attack can be identified based on a distance between the user devices associated with the requests and a time period for which the requests were originated.
1. A system for mitigating denial of service attacks on services in a communications network, the system comprising:
one or more nodes, each of the one or more nodes configured to wirelessly communicate with one or more user devices in a geographic service area; and
one or more processors configured to perform operations comprising:
receive a plurality of requests from the one or more user devices to access an E11 resource;
determine a coordinated attack threshold for a maximum number of requests being generated from within a geographical area and within a predetermined time period, the maximum number of requests being used to access the E11 resource, the coordinated attack threshold determined based on whether an actual emergency has occurred;
determine that a first set of requests within the plurality of requests are a coordinated attack on the E11 resource by identifying that the first set of requests satisfy the coordinated attack threshold; and
generate an instruction to re-route the first set of requests to a destination other than the E11 resource based the first set of requests being the coordinated attack.
2. The system of claim 1 , wherein the destination other than the E11 resource is a virtual queue.
3. The system of claim 2 , wherein the virtual queue is an intermediate automated resource.
4. The system of claim 2 , wherein the virtual queue is a voice mail box configured to receive one or more messages to be directed to the E11 resource.
5. The system of claim 2 , wherein the virtual queue is a pre-recorded message.
6. The system of claim 1 , wherein the E11 resource is an emergency 911 service.
7. The system of claim 1 , wherein the predetermined time period is less than or equal to five minutes.
8. The system of claim 1 , wherein the coordinated attack a utilization threshold further identifies that the first set of requests is generated from a plurality of user devices within a predetermined distance from one another.
9. The system of claim 8 , wherein the one or more processors are further configured to maintain a count of requests originating from the geographical area.
10. A non-transitory computer readable media, having instructions stored thereon, that, when executed by one or more processors, cause the one or more processors to carry out a method for mitigating a denial of service attack, the method comprising:
receiving a plurality of requests from one or more user devices to access an E11 resource;
determining a coordinated attack threshold for a maximum number of requests being generated from within a geographical area and within a predetermined time period, the maximum number of requests being used to access the E11 resource, the coordinated attack threshold determined based on whether an actual emergency has occurred;
determining that a first set of requests within the plurality of requests are a coordinated attack on the E11 resource by identifying that the first set of requests satisfy the coordinated attack threshold; and
generating an instruction to re-route the first set of requests to a destination other than the E11 resource based on determining the first set of requests are the coordinated attack.
11. The computer readable media of claim 10 , wherein the E11 resource is an emergency 911 service.
12. The computer readable media of claim 10 , wherein the destination other than the E11 resource is a virtual queue.
13. The computer readable media of claim 12 , wherein the virtual queue is an intermediate automated resource.
14. The computer readable media of claim 12 , wherein the virtual queue is a voice mail box configured to receive one or more messages to be directed to the E11 resource.
15. The computer readable media of claim 12 , wherein the virtual queue is a pre-recorded message.
16. The computer readable media of claim 10 , wherein the predetermined time period is less than or equal to five minutes.
17. The computer readable media of claim 10 , wherein the coordinated attack threshold further identifies that the first set of requests is generated from a plurality of user devices within a predetermined distance from one another.
18. The computer readable media of claim 10 , wherein the method further comprises maintaining a count of requests originating from the geographical area.
19. A method for mitigating denial of service attacks, the method comprising:
receiving a plurality of requests from user devices to access an E11 resource;
determining that a first set of the plurality of requests from a set of the user devices are a coordinated attack on the E11 resource by identifying that the set of the plurality of requests satisfy a utilization threshold, wherein the utilization threshold indicates a maximum number of requests generated from a geographical area within a predetermined time period and within a predetermined distance from at least one of the set of the user devices that can access the E11 resource; and
generating an instruction to re-route the set of the plurality of requests to a destination other than the E11 resource based on determining the set of the plurality of requests are the coordinated attack.
20. The method claim 19 , wherein the method further comprises maintaining a count of requests originating from the geographical area.