Distributed denial-of-service signature transmission

1. A method of transmitting a distributed denial of service (DDoS) signature from an intra-network to an internet, comprising:

identifying a DDoS signature using a network node within an intra-network;

employing an inter-domain routing protocol to enable operational information to be exchanged between network nodes;

embedding the DDoS signature and a throughput threshold as a payload of the inter-domain routing protocol, wherein the embedding occurs within the intra-network; and

sending the embedded DDoS signature and throughput threshold from the intra-network to an internet node,

wherein the DDoS signature is to be used by the internet node to filter packets matching the DDoS signature, and

wherein the throughput threshold is to be used by the internet node to terminate the use of the DDoS signature when a throughput of the DDoS signature is less than the throughput threshold for a measurement interval.

2. The method of claim 1 , wherein the internet node is modified to recognize the embedded DDoS signature.

3. The method of claim 1 , wherein the inter-domain routing protocol is Border Gateway Protocol (BGP).

4. The method of claim 1 , wherein the internet node sends the DDoS signature to additional internet nodes using the inter-domain routing protocol.

5. The method of claim 1 , further comprising:

embedding the measurement interval as a payload of the inter-domain routing protocol; and

sending the embedded measurement interval from the intra-network to the internet node.

6. The method of claim 1 , further comprising:

applying the DDoS signature to enable the internet node to filter packets matching the DDoS signature;

monitoring a throughput of the DDoS signature at the internet node;

comparing the throughput of the DDoS signature and the throughput threshold for the measurement interval; and

terminating filtering of packets matching the DDoS signature when the throughput of the DDoS signature is less than the throughput threshold for the measurement interval at the internet node.

7. The method of claim 6 , further comprising propagating a signature withdrawal message from the internet node if the throughput of the DDoS signature is less than the throughput threshold for the measurement interval.

8. The method of claim 1 , wherein at least one of the network nodes within the intra-network is a router.

9. The method of claim 8 , wherein the router is a border router.

10. The method of claim 6 , wherein applying the DDoS signature to enable the internet nodes to filter packets matching the DDoS signature includes applying the DDoS signature as an access control list (ACL).

11. The method of claim 10 , wherein the access control list (ACL) is implemented as rules in tertiary content addressable memory (TCAM) of the internet node.

12. A method of transmitting a distributed denial of service (DDoS) signature from an intra-network to an internet, comprising:

identifying a DDoS signature using a network node within an intra-network;

employing an inter-domain routing protocol configured to enable operational information to be exchanged between network nodes;

embedding the DDoS signature and a throughput threshold as a payload of the inter-domain routing protocol, wherein the embedding occurs within the intra-network;

sending the embedded DDoS signature and throughput threshold from the intra-network to an internet node;

applying the DDoS signature to enable the internet node to filter packets matching the DDoS signature;

monitoring a throughput of the DDoS signature at the internet node for a measurement interval;

comparing the throughput of the DDoS signature to the throughput threshold; and

terminating filtering of packets matching the DDoS signature when the throughput of the DDoS signature is less than the throughput threshold for the measurement interval at the internet node.

13. A system for responding to a distributed denial of service (DDoS) attack, comprising: a device in an intra-network, the device including a processor and a memory, the memory storing instructions which when executed by the processor cause the device to:

identify attack data;

output an anomaly signature associated with the DDoS attack in response to the attack data; and

embed the anomaly signature and a throughput threshold as a payload of an inter-domain routing protocol communication and send the embedded anomaly signature and throughput threshold to an internet node,

wherein the anomaly signature is to be used by the internet node to filter packets, and

wherein the throughput threshold is to be used by the internet node to terminate the use of the anomaly signature when a throughput of the anomaly signature is less than the throughput threshold for a measurement interval.

14. The system of claim 13 , wherein the internet node is outside the network to receive an inter-domain routing protocol packet including the embedded anomaly signature, wherein the internet node is to utilize the anomaly signature to block or drop packets matching the anomaly signature.

15. The system of claim 13 , wherein inter-domain routing protocol is Border Gateway Protocol (BGP).

16. The system of claim 13 , wherein the device is a monitoring router.

17. The system of claim 14 , wherein the internet node outside the intra-network is modified to recognize the anomaly signature.

18. The system of claim 13 , further comprising a router in the intra-network to receive the embedded anomaly signature and transmit the embedded anomaly signature to the internet node outside the network.

19. The system of claim 14 , wherein the internet node outside the network is a border router.