System and method for avoiding and mitigating a DDoS attack
Described is a system and method for receiving a data packet including a destination address and a source address, the data packet corresponding to a port number, assigning an address risk value for the data packet based on the source address and a port risk value for the data packet based on the port number. The data packet is categorized into a community based on the source address, wherein the community is predefined by a user corresponding to the destination address, the community includes a utility value. The address risk value and the port risk value are compared to the utility value to yield a benefit coefficient and the data packet is treated based on the benefit coefficient.
1. A method, comprising:
receiving a data packet including a destination address and a source address, the data packet corresponding to a port number;
assigning an address risk value for the data packet based on the source address;
assigning a port risk value for the data packet based on the port number;
categorizing the data packet into a community based on the source address, wherein the community is predefined by a user corresponding to the destination address, the community including a utility value; and
comparing the address risk value and the port risk value to the utility value to yield a benefit coefficient; and
selecting a treatment for the data packet based on the benefit coefficient.
2. The method of claim 1 , wherein the treatment includes restricting further transmission of the data packet.
3. The method of claim 1 , wherein the treatment includes limiting the rate of the transmission of the data packet.
4. The method of claim 1 , wherein the treatment includes transmitting the data packet to a customer router corresponding to the destination address.
5. The method of claim 1 , wherein the categorizing the data packet includes:
comparing the destination address of the data packet to a customer address;
retrieving a access control list corresponding to the customer address including the community;
comparing the port number of the data packet to the access control list; and
comparing the source address of the data packet to the access control list.
6. The method of claim 5 , wherein the access control list includes a plurality of communities.
7. The method of claim 5 , wherein the access control list includes a benefit coefficient threshold.
8. The method of claim 1 , further comprising:
receiving, prior to selecting a treatment, a customer input changing the benefit coefficient.
9. The method of claim 1 , wherein the community is predefined by the user based on IP prefixes.
10. A router, comprising:
a receiving module receiving a data packet including a destination address and a source address, the data packet corresponding to a port number;
a risk assignment module assigning an address risk value for the data packet based on the source address and a port risk value for the data packet based on the port number;
a routing table categorizing the data packet into a community based on the source address, wherein the community is predefined by a user corresponding to the destination address, the community including a utility value;
a comparison module comparing the address risk value and the port risk value to the utility value to yield a benefit coefficient; and
a selection module selecting a treatment for a data packet based on the benefit coefficient.
11. The router of claim 10 , wherein the treatment includes restricting further transmission of the data packet.
12. The router of claim 10 , wherein the treatment includes limiting the rate of the transmission of the data packet.
13. The router of claim 10 , wherein the treatment includes transmitting the data packet to a customer router corresponding to the destination address.
14. The router of claim 10 , wherein the routing table categorizing the data packet includes:
a first comparator module comparing the destination address of the data packet to a customer address;
a retrieving module retrieving a access control list corresponding to the customer address including the community;
a second comparator module comparing the port number of the data packet to the access control list; and
a third comparator module comparing the source address of the data packet to the access control list.
15. The router of claim 14 , wherein the access control list includes a plurality of communities.
16. The router of claim 14 , wherein the access control list includes a benefit coefficient threshold.
17. The router of claim 14 , wherein the third comparator module comparing the port number performs a comparison between the benefit coefficient to the benefit coefficient threshold.
18. The router of claim 10 , wherein the source and destination addresses are IP addresses.
19. The method router of claim 10 , wherein the community is predefined by the user based on IP prefixes.
20. A computer readable storage medium including a set of instructions executable by a processor, the set of instructions operable to:
receive a data packet including a destination address and a source address, the data packet corresponding to a port number;
assign an address risk value for the data packet based on the source address;
assign a port risk value for the data packet based on the port number;
categorize the data packet into a community based on the source address, wherein the community is predefined by a user corresponding to the destination address, the community including a utility value; and
compare the address risk value and the port risk value to the utility value to yield a benefit coefficient; and
select a treatment for the data packet based on the benefit coefficient.