Patent ID: 9167004
Filing Date: 2015-10-20
Classification: H04L

Abstract:
1. A method of addressing a Distributed Denial of Service (DDoS) attack on a flow-state system comprising: generating a plurality of packet flows traveling through the flow-state system, each packet flow being generated as a first packet of the packet flow travels through the flow-state system, each packet flow having a sequence of packets that have matching attributes with each other; generating a plurality of flow-state records for the plurality of packet flows based on attributes associated with the plurality of packet flows, each flow-state record storing a set of attributes and a set of state information associated with a corresponding packet flow, each flow-state record being updated with state information of each packet of the corresponding packet flow, as each packet travels through the flow-state system; generating a plurality of aggregate records from the plurality of flow-state records, each aggregate record being generated by aggregating a subset of the plurality of flow-state records into the aggregate record, the aggregating based on a subset of the attributes used to generate the plurality of flow-state records; monitoring the plurality of aggregate records at one or more nodes within a network in order to detect an anomaly in the plurality of aggregate records; and for each of the plurality of aggregate records: executing a first anomaly algorithm, the first anomaly algorithm having a first associated weight, wherein executing the first anomaly algorithm comprises: computing a first traffic deviation factor; and computing a first individual probability of attack based on the first traffic deviation factor; executing a second anomaly algorithm on the plurality of aggregate records, the second anomaly algorithm having a second associated weight, wherein executing the second anomaly algorithm comprises: computing a second traffic deviation factor; and computing a second individual probability of attack based on the second traffic deviation factor; computing a net probability of attack as a sum of a first product and a second product, wherein the first product includes the first individual probability of attack multiplied by the first associated weight; wherein the second product includes the second individual probability of attack multiplied by the second associated weight; determining whether the net probability of attack is above a net probability threshold; and in response to the net probability of attack being above the net probability threshold: identifying a candidate node, from the one or more nodes within the network, as being an attack victim, the candidate node identified based on the candidate node having a particular aggregate record exhibiting the anomaly; identifying a set of source addresses (SAs) associated with a set of client nodes sending traffic to the candidate node within the network; and for each SA: determining whether the SA is a legitimate or spoofed SA; and applying a local mitigation action to a subset of flows, of the plurality of packet flows, that are associated with the SA, based on whether the SA is a legitimate or spoofed SA.