Patent ID: 9088607
Filing Date: 2015-07-21
Classification: H04L

Abstract:
1. A method implemented by a network device for providing network attack protection against distributed denial of service attacks, comprising: receiving, by the network device, information about an attack source, wherein the information about the attack source carries address information about an attacker, wherein the attacker is controlled by a malicious controller to launch a denial-of-service attack, and the attacker and the malicious controller are separate network entities; obtaining, by the network device, address information about a gateway corresponding to the attacker according to the address information about the attacker and a preset mapping relationship between the attacker and the gateway corresponding to the attacker; sending, by the network device, a first control message to the gateway corresponding to the attacker, wherein the first control message instructs the gateway corresponding to the attacker to control traffic of the attacker for preventing upstream network traffic of a victim host of the denial of service attack from being blocked; obtaining, by the network device, address information about the malicious controller according to the address information about the attacker; obtaining, by the network device, address information about a gateway corresponding to the malicious controller according to the address information about the malicious controller and a preset mapping relationship between the malicious controller and the gateway corresponding to the malicious controller; and sending, by the network device, a second control message to the gateway corresponding to the malicious controller, wherein the second control message instructs the gateway corresponding to the malicious controller to control traffic of the malicious controller for preventing upstream network traffic of the victim host from being blocked.