Abstract:
A method and system are provided for preventing network service shutdowns resulting from denial of service (DOS) attacks. First, parameters are monitored corresponding to network elements carrying communication signal traffic in a communications network, and, based on the parameters, if a DOS attack is indicated, performing the following for each instance of communication signal traffic: accessing data structures for data relating to protected communication signal traffic, and, based on the data, determining if the communication signal traffic is designated as protected. Finally; based on the determination, cleaning and forwarding each protected communication signal to its respective destination.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     Not applicable. 
     STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT 
     Not applicable. 
     BACKGROUND 
     Network infrastructures as well as customers of network service providers may be subject to any number of malicious attacks by hostile machines (attackers) designed to shutdown or damage network services. One common type of attack is a distributed denial of service (DDOS) or denial of service (DOS) attack. A DOS attack may encompass one of two common attack types. One type of a DOS attack involves an attacker sending a sufficiently large number of messages to a targeted IP address, such as a client of a network service provider. Another type of attack is more general in nature, and targets the core network of the network service provider, which, in turn, affects service to all clients of the service provider. 
     DOS attacks generally involve an attacker forging (spoofing) messages and sending the spoofed messages to a targeted destination. The targeted destination may be, for example, a router within the core network of the service provider or a customer of the service provider. With a sufficiently large number of spoofed messages, the targeted destination&#39;s services (e.g. phone and data services) may become clogged and rendered inoperable. 
     Many service providers offer to customers, in addition to network service, detection and mitigation service subscriptions to prevent interruptions in the customer&#39;s service due to malicious attacks. Detection services determine whether the subscribed customer or network core is experiencing a DOS attack. On the other hand, mitigation services separate good traffic from bad traffic and forwards the good traffic to the subscribed customers. 
     Detection service may be provided at the customer-end of the network, or in the core network of the service provider, such as at an incoming provider-edge (PE) router. Further, the detection service may be implemented as computer-readable medium or integrated as a part of the network architecture. At the customer-end of the network, detection service may employ an in-line tap and detector coupled to the service provider&#39;s network pathway. A tap may be, in one example, a passive splitter that siphons off a portion of the incoming traffic and directs the siphoned portion to a detector having a suitable bandwidth. The detector monitors the bandwidth usage of the service provider&#39;s network by the customer and, over time, determines if the bandwidth usage has increased beyond a certain threshold. This increased use may indicate a malicious attack is in progress. If the detector determines an attack is in progress, the traffic incoming to the customer is routed to a cleaning center. The cleaning center separates the bad traffic from the good traffic. The separation may be based upon information in the header portion of the incoming messages. The good traffic is then redirected to the customer, thus mitigating the malicious attack and minimizing downtime experienced by the customer due to the attack. 
     At the network core, detection service may employ monitoring tools for collecting information related a trend in the bandwidth usage that extends beyond a certain threshold, which indicates a malicious attack. The monitoring tools may comprise a stand-alone hardware element incorporated into the network architecture or computer-readable medium installed on an existing hardware element. Once the threshold is met, the network service provider shuts down all network elements and pathways in the core network affected by the malicious attack. The shutdown prevents damage and other adverse consequences to components in the core network and related customer-end network elements. Once the monitoring tools determine the malicious attack has subsided, the service provider re-opens all network elements previously shutdown. 
     One deficiency of the aforementioned detection services on the customer-end is the cost and efficiency of providing detection services for each individual subscribing customer. Further, another deficiency of providing the aforementioned detection services on the front-end provider-edge of the core network is that an outage of network service to all customers occur during the attack. Although a customer subscribes to detection and mitigation services offered by the network service provider, the service shutdown in response to the malicious attack may last about a few hours to a few days. 
     This background is provided as just that, background. The invention is defined by the claims below, and the listing of any problems or shortcomings of the prior art should not give rise to an inference that the invention is only to address these shortcomings. 
     SUMMARY 
     Some embodiments of the present invention solve at least the above problems by providing a system and method for providing efficient and cost-effective detection of malicious attacks on network service providers and their related customers. Moreover, embodiments of the present invention have several practical applications in the technical arts including, but not limited to, prevention of network service shutdowns due to malicious attacks, and differentiation at the network core of inbound network traffic to subscribed and unsubscribed customers of detection and mitigation services of the service provider amid a malicious attack. 
     In one embodiment, a system is provided for differentiating protected from unprotected inbound communication signals during a network service attack on a communications network. The system comprises a monitoring apparatus in communication with several network elements in the communications network. The monitoring apparatus monitors bandwidth-usage statistics of the network elements. Further, a differentiation apparatus is in communication with the monitoring apparatus and if the monitoring apparatus detects anomalies in the usage of network elements, indicative of a network service attack, the inbound communication signals may be forwarded to the differentiation apparatus that distinguishes between unprotected and protected communication signals. 
     In another embodiment, a method is provided for preventing network service shutdowns resulting from denial of service (DOS) attacks. The method comprises monitoring parameters corresponding to network elements carrying communication signal traffic in a communications network, and, based on the parameters, if a DOS attack is indicated, performing the following for each instance of communication signal traffic: accessing data structures for data relating to protected communication signal traffic, and, based on the data, determining if the communication signal traffic is designated as protected. Finally; based on the determination, cleaning and forwarding each protected communication signal to its respective destination. 
    
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
       Embodiments of the present invention are described in detail below with reference to the attached drawing figures, which are incorporated by reference herein and wherein: 
         FIG. 1  is a diagram of one embodiment of the present invention illustrating detection services deployed in a communications network; 
         FIG. 2A  is a diagram illustrating one embodiment of  FIG. 1  illustrating detection services architecture at the customer-end of communications network; 
         FIG. 2B  is a diagram of another embodiment  FIG. 1  illustrating detection service architecture at the customer-end of communications network; 
         FIG. 3A  is a flowchart illustrating one embodiment of a method for centralizing services subscribed to by customers of a service provider for detecting attacks at the customer-end of a communications network 
         FIG. 3B  is a flowchart of one embodiment of the present invention illustrating a method for determining components of the architecture of  FIG. 2B ; 
         FIG. 4  is a diagram of one embodiment of the present invention illustrating detection services at a front-end provider-edge; 
         FIG. 5  is a diagram of the network architecture of  FIG. 4 ; and 
         FIGS. 6A and 6B  is a flowchart illustrating a method for implementing the architecture of  FIGS. 4-5 . 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     The various embodiments of the present invention provide a system and method for providing efficient and cost-effective detection services of malicious attacks on network service providers and their related customers. More particularly, but not by way of limitation, embodiments of the present invention provide for centralizing services subscribed to by customers of a service provider for detecting attacks at the customer-end of a communications network. Moreover, but not by way of limitation, embodiments of the present invention provide for detection services at a front-end provider edge with the feature of differentiating between subscribing and non-subscribing customers of a network service provider&#39;s detection and mitigation services. 
     Further, various technical terms are used throughout this description. A definition of such terms can be found in Newton&#39;s Telecom Dictionary by H. Newton, 20th Edition (2004). These definitions are intended to provide a clearer understanding of the ideas disclosed herein but are in no way intended to limit the scope of the embodiments of the present invention. The definitions and terms should be interpreted broadly and liberally to the extent allowed the meaning of the words offered in the above-cited reference. 
     As one skilled in the art will appreciate, the embodiments of the present invention may take the form of, among other things: a method, system, or computer-program product. Accordingly, the embodiments of the present invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware. Embodiments of the present invention include the form of a computer-program product that includes computer-useable instructions embodied on one or more computer-readable media. 
     Computer-readable media include both volatile and nonvolatile media, removable and nonremovable media, and contemplates media readable by a database, a switch, and various other network devices. Network switches, routers, and related components are conventional in nature, as are means of communicating with the same. By way of example, and not limitation, computer-readable media comprise computer-storage media and communications media. 
     Computer-storage media, or machine-readable media, include media implemented in any method or technology for storing information. Examples of stored information include computer-useable instructions, data structures, program modules, and other data representations. Computer-storage media include, but are not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile discs (DVD), holographic media or other optical disc storage, magnetic cassettes, magnetic tape, magnetic disk storage, and other magnetic storage devices. These memory components can store data momentarily, temporarily, or permanently. 
     Communications media typically store computer-useable instructions—including data structures and program modules—in a modulated data signal. The term “modulated data signal” refers to a propagated signal that has one or more of its characteristics set or changed to encode information in the signal. An exemplary modulated data signal includes a carrier wave or other transport mechanism. Communications media include any information-delivery media. By way of example but not limitation, communications media include wired media, such as a wired network or direct-wired connection, and wireless media such as acoustic, infrared, radio, microwave, spread-spectrum, and other wireless media technologies. Combinations of the above are included within the scope of computer-readable media. 
     Turning now to  FIG. 1 , there is illustrated one embodiment of an exemplary communications network architecture  100 . Architecture  100  includes, but is not limited to, machines  110  and  112  that generate inbound communication signal traffic to customers  122  through provider-edge access points  116 A and  116 B. The inbound traffic may comprise both legitimate traffic and traffic for purposes of malicious attacks. 
     Machines  110  and  112  may include, but are not limited to personal computers or computer terminals. Architecture  100  further includes, but is not limited to, a network  114 , customer-edge access points  116 C and  116 D, detection service architectures  120 A and  120 B, and routers and/or switches  118 A and  118 B. Access points  116 A-D may include, but are not limited to routers and/or switches. The aforementioned components of architecture  100  provide a simplified network architecture having detection and mitigation services integrated therein for purposes of illustrating general concepts involved in the various embodiments of the present invention. Thus, architecture  100  is not intended to limit the scope of the various embodiments of the present invention. Other embodiments may include additional access points, routers and/or switches, and additional detection service architectures. 
     With continuing reference to  FIG. 1 , detection service architecture  120 A detects malicious attacks from hostile machines  110  and/or  112  at front-end provider-edge access points  116 A and  116 B of network  114 . Architecture  120 A receives incoming communication signals from access points  116 A and  116 B via router and/or switch  118 A and distinguishes between customers subscribed to detection and mitigation services and non-subscribed customers. When an attack is underway, detection center  120 A forwards a subscribed customer&#39;s inbound communication signal traffic to cleaning center  124 . Cleaning center  124  performs attack mitigation services for subscribed customers  122 . More particularly, cleaning center  124  separates attacking inbound communication signal traffic (bad traffic) from legitimate inbound communication signal traffic (legitimate traffic). Detection architectures  120 B provide detection services at the customer-end of network  114 . If detection architectures  120 B determine an attack is underway, incoming communication signals to customers  122  are forwarded via router and/or switch  118   b  to cleaner center  124 . The infrastructure and functionality of detection architecture  120 A will be discussed in further detail with reference to  FIGS. 4-6 . The infrastructure and functionality of detection architecture  120 B will be discussed in further detail with reference to  FIGS. 2A-3C . 
     Referring now to  FIG. 2A , there is illustrated one embodiment of detection service architecture at the customer-end of a communications network. A system architecture  200  comprises a malicious attacker-machine  214 , a legitimate user-machine  216 , front-end provider-edge access points  220 A and  220 B, customer-end provider-edge access points (router and/or switch)  220 C and  220 D, subscribing customers  236 A and  236 B, communications network  218 A, network core  218 B, router and/or switch  224 , and cleaning center  238 . Subscribing customers  236 A and  236 B comprise customer-edge routers  220 E and  220 F, switches and/or routers  230 A and  230 B, in-line communication signals taps  232 A and  232 B, customer networks  218 C, detectors  234 A and  234 B. Network  218 A further comprises differentiator  228 . Differentiator  228  comprises routers and/or switches  228 A-D coupled to cleaning center  238 . Further, routers and/or switches  228 A-D may be coupled to databases (not shown) comprising subscribing customer information. Network core  218 B further comprises routers and/or switches  222 A- 222 C. A network  212  is provided for illustrative purposes and comprises a collection of “zombie” machines  212 A. The zombie machines  212 A provide a collection of potential addresses that an attacker-machine may utilize for spoofing messages. 
     In operation, network  218 A of system architecture  200  receives legitimate inbound communication signal traffic from user-machine  216  and malicious inbound communication signal traffic from attacker-machine  214  at provider-edge access points  220 A and  220 B. Provider-edge access points  220 A and  220 B route the incoming traffic, which includes both legitimate traffic from user-machine  216  and attacking traffic from attacker-machine  214  to core network  218 B. Routers and/or switches  220 A- 220 C route the incoming traffic to customer-end provider-edge access point  220 D. Access point  220 D routes inbound traffic to subscribing customers  236 A and  236 B via customer-edge routers and/or switches  220 E and  220 F. Inbound traffic to subscribing customers  236 A and  236 B is routed through switches  230 A and  230 B and taps  232 A and  232 B. Taps  232 A and  232 B may be passive taps. In one embodiment, a passive tap comprises a splitter which diverts a portion of the total inbound traffic to a detector to detectors  234 A and  234 B prior to the inbound traffic reaching customer networks  218 C. 
     Continuing with  FIG. 2A , customers  236 A and  236 B are allotted a certain amount of bandwidth to access network  218 A. Customers  236 A and  236 B may be, for example, but not by way of limitation, DS-1 customers or fast-Ethernet customers. Detectors  234 A and  234 B monitor the inbound traffic and over time determine if the inbound traffic is above a certain threshold specific for customers  236 A and  236 B. This technique may be termed “trending”. If detectors  234 A and  234 B determine that the amount of inbound traffic is increasing or shows a spike, detectors  234 A and  234 B determine that an attack is underway and route inbound traffic to customers  236   a  and  236 B to differentiator  228 A via router and/or switch  224 . Differentiator  228  determines the preferences stored in data structures for customers  236 A and  236 B and forwards inbound traffic to customers  236 A and  236 B is diverted to cleaning center  238 . Cleaning center  238  separates the attacking or bad traffic inbound traffic from legitimate inbound traffic. In one embodiment, this may be done by analyzing the header fields of the inbound traffic to the subscribing customers. 
     Referring now to  FIG. 2B , there is illustrated one embodiment of the present invention for consolidating detection service architecture at the customer-end of a communications network. In  FIG. 2B , components common to  FIG. 2A  will have the same number in  FIG. 2B . A system architecture  202  comprises substantially the same elements as  FIG. 2A , with the exception of a consolidated or centralized detection center  218 C. Detection center  218 C comprises a router and/or switch  220 G for accepting inbound traffic and a common tap  230 A, detector  234 B, router and/or switch  220 F, and router and/or switch  230 B. Also illustrated in system  200  are customers  236 A,  236 B,  236 C and  236 D. Customers  236 B-D are customers that subscribe to the network service provider&#39;s detection and mitigation services, while customer  236 A is a non-subscriber. 
     System  202  of  FIG. 2B  operates in substantially the same manner as system  200  of  FIG. 2A , with inbound traffic received at router and/or switch  220 G. Router and/or switch  220 G is in communication with differentiator  228  and based on subscribing customers included in databases  228 A- 228 D and differentiator  228  routes traffic directly to either customer-edge router and/or switch  220 E or common tap  230 A. tap  230 A, as in  FIG. 2A , diverts a portion of inbound communication signals to subscribing customers  236 B-D to a common detector  234 B. As in system  200  of  FIG. 2A , common detector  234 B analyzes, based on the bandwidth requirements of subscribing customers  236 B-D, whether or not a substantial increase in inbound communication signal traffic is occurring. If a substantial increase in traffic is inbound to subscribing customers  236 B-D, detector  234 B routes the inbound traffic via router and/or switch  220 F to differentiator  228 , or to cleaning center  238  via router and/or switch  224 . In this way, subscribing customers  236   b - d  do not each individually include a tap  230 A and detector  234 B. Requirements for common tap  230 A and detector  234 B will be discussed in further detail in regards to  FIGS. 3A-3B . 
     Referring now to  FIG. 3A , there is illustrated one embodiment of a method  300  for centralizing detection services subscribed to by customers of service providers at the customer-end of a communications network. At a step  310  a signal diverter or tap is coupled to a communication signal path carrying inbound communication signals to a customer. At a step  312 , a detection apparatus or detector is coupled to the signal diverter. At a step  314 , a portion of the inbound communication signals propagating through the signal path is diverted to the detection apparatus or detector. Finally, At a step  316 , method  300  includes determining, based on parameters for each customer, if the customer is experiencing a malicious attack. The parameters include, but are not limited to, normal bandwidth usage of the customer and the customer&#39;s allotted bandwidth. 
     Referring to  FIG. 3B , there is illustrated an embodiment of the present invention of a method  302  for selecting components of a detection architecture for detection services at the customer-end. For example, but not by way of limitation, detection architecture  200  of  FIG. 2B . Centralizing detection services may require selecting a number of taps and the number of detectors required to centralize detection services described in the aforementioned  FIGS. 1-3A . With reference to  FIG. 3B , at a step  318 , the number of subscribing customers and their respective allotted bandwidth usage is determined to select a suitable detector and tap. At a step  320 , the total number of detectors required to centralize detection services is determined. The selection of detectors may be limited to the bandwidth of available detectors. For example, but not by way of limitation, available detectors may have bandwidths of 1000 Mbps (Mega-bits-per-second). Assume that at step  318 , the number of customers and respective allotted bandwidths are as follows:
         A=number of DS-1 (1.544 Mbps) customers;   B=number of DS-3 (44.736 Mbps) customers;   C=number of OC-3 (155.52 Mbps) customers;   D=number of OC-12 (622 Mbps) customers;   E=number of fast-Ethernet (100 Mbps) customers; and   F=number of gigabyte-Ethernet (1000 Mbps) customers.       

     Given the aforementioned information, the total number of detectors having a bandwidth of X Mbps for centralizing detection services is calculated using equation (1) below. 
                     Total   ⁢           ⁢   detectors     =               A   *   1.544     +     B   *   44.736     +     C   *   155.52     +                 D   *   622     +     E   *   100     +     F   *   1000             X             (   1   )               
Given the bandwidth of available detectors is 1000 Mbps, and assuming, for simplicity, the number of customers for each allotted bandwidth offered by a service provider is one, then the total detectors should be at least two. The total number of detectors from equation (1) should be rounded-up to the nearest integer.
 
     Continuing with method  302  of  FIG. 3B , at a step  320  the total number of taps required to centralize detection services may be calculated in a similar manner. For example, given the number of customers for each bandwidth offered by the service provider as determined in step  318 , the minimum number of taps may be calculated as follows using equation (1) above. In other words, assuming the tap has a bandwidth of 1000 Mbps, the total number of taps should be,
 
Total taps= A* 0.001544 +B* 0.044736 +C* 0.15552 +D* 0.622 +E* 0.1 +F.  
 
The total number of taps should be the nearest rounded-up integer of the above result. In this example, the total number of taps should be 2.
 
     At a step  324 , the detectors and taps are coupled between one provider-edge router and/or switch and another provider-edge router and/or switch that is coupled to the customer-edge routers and/or switches which service the subscribing customers. Thus, to service six subscribing customers having varying allotted bandwidths, two detectors and taps should be used. 
     Referring again to  FIG. 1 , the infrastructure and functionality of detection architecture  120 A may be illustrated by exemplary detection architecture  400  of  FIG. 4 . In  FIG. 4 , there is shown one embodiment of the present invention illustrating detection service architecture  400  at a front-end provider-edge of a service provider&#39;s network. Detection service architecture  400  comprises monitoring tools  410 , differentiator  412 , data structures  414  and  416 , router and/or switch  418 , and cleaning center  420 . Monitoring tools  410  include, but not limited to a computer-readable medium located on a processor in network  114  of  FIG. 1  or integrated into a provider-edge router and/or switch. Monitoring tools  410  collect data and statistics (network resource utilization) relating to various elements in the infrastructure of a service provider&#39;s network. Monitored elements may include, but are not limited to, signal pathways or links  410 A, access points (router and/or switches)  410 B, ports  410 C, and processors  410 D. The statistics and data collected by monitoring tools  410  may be utilized to indicate whether or not the service provider&#39;s infrastructure is under attack. Once a determination is made regarding an attack, inbound communication signal traffic may be diverted to differentiator  412 . Differentiator  412  accesses data structures  414  and  416  to determine if a subscribed customer&#39;s inbound traffic or other traffic designated for protection is affected. The subscribed customer&#39;s inbound traffic and other traffic is then forwarded through a router and/or switch  418  to cleaning center  420  for separating the attacking traffic from the legitimate traffic. 
     Referring now to  FIG. 5 , there is illustrated in greater detail the detection service architecture  400  discussed in relation to  FIG. 4 . In  FIG. 5 , detection service architecture  500  includes a service provider network  502 , a malicious attacker-machine  510 , a network  512  having a collection of “zombie” machines  512 A, a legitimate user-machine  514 , and front-end provider-edge routers and/or switches  516 A-B for receiving inbound communication signal traffic. Network  502  includes network core  518  having routers and/or switches  518 A-C. The aforementioned monitoring tools may be incorporated into routers and/or switches  518 A-C or front-end provider-edge routers and/or switches  516 A-B. Network  502  further includes a detection architecture  528  and a cleaning center  534  coupled to detection architecture  528  through a router and/or switch  532 . Further, detection architecture  528  is coupled to network core  518  through a router and/or switch  522 . Detection architecture  528  includes a differentiator  526 , data structures  530  and link utilization monitor  524 . 
     In operation, attacker-machine  510  may generate a malicious attack on network  502  incorporating spoofed messages using zombie machines  512 A of network  512 . Legitimate inbound communication signal traffic may be generated by legitimate user-machine  514 . Both attacking and legitimate inbound communication signals are received by provider-edge routers and/or switches  516 A-B and forwarded to routers and/or switches  518 A-C in network core  518 . Monitoring tools incorporated into network core  518  analyze statistics of inbound communication signal traffic as discussed above in relation to  FIG. 4 . Once the malicious attack from attacker-machine  510  is detected, the inbound communication signals may be redirected to detection architecture  528  through router and/or switch  520 . Inbound communication signals may be redirected by way of a virtual network path or predetermined routing protocols. Router and/or switch  522  receives the redirected inbound communication signals and forwards the signals to the link utilization monitor (LUM)  524 . LUM  524  processes the redirected signals and determines if network  502  is experiencing an attack. If LUM  524  determines an attack is underway, the redirected signals are forwarded to differentiator  526  to determine if said signals include subscriber and/or protected traffic. Differentiator  526  consults data structures  526 A for subscriber and protected traffic information and forwards the redirected signals having the subscriber and protected traffic information to cleaning center  534  through router and/or switch  532 . As previously discussed, cleaning center  534  separates attacking and legitimate communication signal traffic and forwards legitimate traffic to the subscribing customers. 
     Referring now to  FIG. 6 , there is shown one embodiment of the present invention of a method  600  for detecting a malicious attack on a service provider&#39;s infrastructure at a front-end provider-edge of the service provider&#39;s network. At a step  610 , elements within the service provider&#39;s network are monitored for predetermined changes in the element&#39;s usage statistics. As previously discussed, a significant change in usage statistics over time (trending) may indicate a network is under attack by a hostile machine. At a step  620 , if anomalies are detected in the usage statistics of the various monitored network elements, the inbound communications signal traffic may be diverted to a detection architecture at a step  630 . This diversion of inbound traffic may be accomplished by routing changes or by creating virtual network pathways. The creation of virtual network pathways may be termed “tunneling.” Typical tunneling mechanisms known in the art include, but are not limited to GRE, and L2TPv3. If, however, no anomalies are detected, method  600  returns to step  610  and continues to monitor usage statistics of elements of the service provider&#39;s network. 
     Continuing at a step  640 , the diverted inbound traffic is forwarded a processor, such as LUM  524  of  FIG. 5 , for further analysis to determine if the service provider&#39;s network is under attack. At a step  650 , if a determination is made that an attack is underway, the inbound communication signal traffic is forwarded to a differentiator at a step  660 . The differentiator may consult a data structure or data structures having listings of customers subscribed to detection and mitigation services and other inbound communication signals, such as emergency traffic, specified by the provider for detection and mitigation service protection at a step  670 . The data structures may reside internal to the differentiator or in external data structures. Further, the data structures may be located either in a single location, or distributed throughout the provider&#39;s network. Returning to step  650 , if the processor or LUM  524  of  FIG. 5  determines the provider&#39;s network is not subject to a malicious attack, at a step  650 A the diverted inbound traffic is forwarded to the provider&#39;s customer&#39;s without any further action and method  600  returns to monitoring network elements at step  610 . 
     Continuing at step  670 , for each inbound communication signal, the differentiator determines if the inbound signal is for a subscribed customer or designated as protected by the network service provider. In one embodiment, this may be done by analyzing information contained in the header field of the inbound message. For the aforementioned inbound communication signals for subscribed customers, at a step  680  the differentiator forwards the signals to a cleaning center to remove the malicious attack communication signal traffic from the legitimate traffic. If, however, an inbound communication signal is not designated protected or relates to an unsubscribed customer, the inbound traffic is dropped at a step  670 A. At a step  670 B, when the processor or LUM  524  of  FIG. 5  determines the attack has subsided, method  600  returns to monitoring usage statistics for the provider&#39;s network elements at step  610 . 
     As can be seen, the embodiments of the present invention and its equivalents are well-adapted to provide a new and useful method and system for detecting malicious attacks on a service provider&#39;s communications network. Many different arrangements of the various components depicted, as well as components not shown, are possible without departing from the spirit and scope of the embodiments of the present invention. 
     The embodiments of the present invention has been described in relation to particular embodiments, which are intended in all respects to be illustrative rather than restrictive. Alternative embodiments will become apparent to those skilled in the art that do not depart from its scope. Many alternative embodiments exist but are not included because of the nature of this invention. A skilled programmer may develop alternative means of implementing the aforementioned improvements without departing from the scope of the embodiments of the present invention. 
     It will be understood that certain features and subcombinations are of utility and may be employed without reference to other features and subcombinations and are contemplated within the scope of the claims. Not all steps listed in the various figures need be carried out in the specific order described.