Patent Description:
Content providers (publishers) now use the Internet (and, particularly, the Web) to provide all kinds of content to numerous users throughout the world. For example, television shows and movies may now be accessed from any number of Web sites, and the shows and movies may be served from Internet devices. Print newspapers have migrated to the Web and provide portals through which clients operating some form of computing device (e.g., PC, smart phone, or tablet), with a browser may access numerous forms of content, such as short video clips, articles, images, and audio tracks. Software updates and patches, once provided on disc and mailed to recipients, are now routinely distributed to devices through one or more network connections and devices.

In some instances, content providers connected to the Internet (such as web data providers) may be attacked by a bad actor attempting to gain access to the provider's network or device or to disrupt the operation of the network or device from providing content to other users of the Internet. One such attack is a denial of service (DOS) attack. DOS attacks attempt to make content servers or other resources of a content provider unavailable to legitimate users by overwhelming the provider's equipment. In general, such attacks include flooding a content server or other type of device providing the content with phony requests for information from the device at such a frequency and volume to impede other legitimate traffic or requests from being fulfilled by the content server. A distributed denial of service (DDOS) attack is similar in aim except that the attack is distributed among many devices (typically associated with unique Internet Protocol (IP) addresses), often unbeknownst to those devices, such that requests for the content are received from the various devices, which can number in the thousands or more. As should be appreciated, such attacks may negatively impact the ability of the customer to provide content to legitimate requesters of content or information, effectively blocking the content from being provided to requesting customers. Similarly, network equipment may temporarily fail under the attack load.

<CIT> describes utilizing routing protocol advertisements within a telecommunications network to dynamically automate the allocation of scrubbing devices in response to a distributed denial of service attack.

It is with these observations in mind, among other, that aspects of the present disclosure were conceived.

Aspects of the present disclosure involve systems, methods, computer program products, and the like, for providing scrubbing techniques via a scrubbing architecture of a network to mitigate a denial of service (DOS) or a distributed DOS (DDOS) attack (collectively referred to herein as a DDOS attack) on a destination device connected to the telecommunications network. In one particular embodiment of the present disclosure, the network provides a scrubbing architecture comprising one or more large scrubber devices configured to scrub communications or packets of a large DDOS attack on a destination device or network and one or more small scrubber devices configured to scrub communications or packets during times of non-DDOS attack on the destination device. The large scrubber devices may include larger bandwidth thresholds to accommodate the large amount of traffic directed to the destination device during the DDOS attack. The small scrubber devices of the architecture may have relatively smaller bandwidth thresholds for a peace-time or normal flow of traffic to the destination device. In this manner, all traffic to the destination device, whether during a DDOS attack or during periods before or after the DDOS attack, may be scrubbed by the scrubbing architecture while improving the efficiency of the scrubbing bandwidth for the network.

In one particular embodiment, the network may include a controller or orchestrator device or system associated with the scrubbing architecture to control which scrubber of the scrubbing architecture is tasked with scrubbing packets, either legitimate or as part of a DDOS attack, intended for a destination device. The controller may receive one or more announced routing protocol advertisements from a network device under a DDOS attack. In some instances, the announcing device may be a small scrubber of the scrubbing architecture. In response to receiving the advertisement or announcement, the controller or orchestrator may determine a scrubbing device of the architecture and configure the determined scrubbing device of the network to begin providing the scrubbing service to packets matching the received routing announcement. In addition, the orchestrator may access a database of customer information and associate the received route announcement with a particular customer. Further, a scrubbing service state for the customer (such as whether a customer profile exists on the scrubbing environment, an active or inactive state of the customer profile on the scrubbing environment, a level and type of scrubbing service provided to the customer by the scrubbing environment, etc.) may be obtained or determined by the orchestrator. With the received route announcement and the customer profile and state information, the orchestrator may provide instructions to configure the scrubbing devices of the network based on the received information, either to a large scrubbing device in response to a large DDOS attack and/or to a small scrubbing device in response to a return to normal traffic levels for the protected destination. In this manner, the orchestrator may dynamically shift scrubbing services from a small scrubber to a large scrubber of the architecture (and vice versa) based on information received from the scrubbers of a potential DDOS attack.

<FIG> illustrates an exemplary network environment <NUM> operable to provide scrubbing or other DDOS attack defense services to networks or devices connected to an IP network <NUM>, according to aspects of the present disclosure. In general, the environment <NUM> includes a telecommunications network <NUM> (a specific example of which is a "core network") that connects networks and/or customers to provide and receive one or more network services. In particular, one or more border networks (such as border network A <NUM> and/or border network B <NUM>) may connect to the IP network <NUM> to provide and receive communications with other users or other networks via the IP network <NUM>. In one particular example, the network <NUM> may connect the border networks <NUM>,<NUM> to a public network, such as Internet <NUM>. Network devices, such as destination device <NUM>, may also connect to the network <NUM> to receive communications or packets from the network <NUM>. In some instances, such devices <NUM> may be included in a border network <NUM>,<NUM>. With specific reference to <FIG>, the environment <NUM> includes an IP network <NUM>, which may be provided by a wholesale network service provider.

To facilitate the transmission of communication packets/data between computing devices, users, networks, etc., the network <NUM> may include numerous networking devices. Such devices or components may include, but are not limited to gateways, routers, route reflectors, and registrars, which enable communication and/or provide services across the IP network <NUM>. In some instances, the network <NUM> may include edge devices <NUM>-<NUM> that connect to or otherwise provide an interface between network <NUM> and other networks <NUM>,<NUM> or devices <NUM>. Edge devices <NUM>-<NUM> (or gateways) may transmit and/or receive communication packets into and out of the network <NUM>. Transmission of received packets through the network <NUM> may be performed by one or more other network devices connected between the edge devices <NUM>-<NUM>. Communication paths or wires may connect the components of the network <NUM> such that one or more packets may be transmitted between customers or networks via the components of the network <NUM>.

In addition to routing communications between networks <NUM>,<NUM> and/or devices <NUM>, the network <NUM> may also provide one or more services to networks or devices connected or associated with the core network <NUM>. In one example, the network <NUM> may provide a scrubbing service or other defensive service against DDOS attacks against a network or device connected to or associated with the network <NUM>. As described in more detail below, a scrubbing service may direct communications or packets identified as a part of a DDOS attack to a scrubbing device before transmission to the destination device <NUM> or network. In some instances, the scrubbing device may identify those packets that are intended to overwhelm or otherwise harm the destination device <NUM> or network and remove the offending packets from the stream of traffic to the destination, while allowing legitimate requests or traffic to be transmitted to the destination deice <NUM> or network. To provide the scrubbing service to networks <NUM>,<NUM> or devices <NUM> associated with the network <NUM>, the network may include a scrubbing architecture <NUM> comprising one or more network scrubbing devices. One instance of the scrubbing architecture <NUM> may include a tiered-structure of large scrubbers with relatively large bandwidth thresholds and small scrubbers with relatively small bandwidth thresholds. An orchestrator <NUM> may also be included in the network <NUM> for controlling one or more aspects of the scrubbing architecture <NUM>. Operations and methods executed by the orchestrator <NUM> are described in more detail below for managing the scrubbing services provided to networks <NUM>,<NUM> and/or devices <NUM> associated with the network <NUM>.

The network <NUM> may be configured in any manner to facilitate the routing of communications through the network and to provide one or more services to customers or the network <NUM>. For example, the network <NUM> may include a series of interconnected networking devices, such as routers and switches, that receive a communication, analyze the communication to determine a destination, and route the communication to a connected networking device to get the communication closer to a destination or egress point (such as gateway <NUM>). To determine which routes through the network to utilize to route a received communication or packet, components of the network may receive route information through one or more route announcing sessions between the devices. These route announcing sessions provide routing information between the components of the network and between different networks so that components of the Internet and other networks may determine how to route received communication packets.

One particular example of the announcement of routing information occurs in a Border Gateway Protocol (BGP) announcement. In general, BGP information (or BGP session, BGP feed or BGP data) is a table of Internet Protocol (IP) prefixes which designate network connectivity between autonomous systems (AS) or separate networks. BGP information for a network route may include path (including next-hop information), network policies, and/or rule-sets for transmission along the path, among other information. The BGP feed may also include Interior Gateway Protocol (IGP) information for network routes within an Autonomous System (AS) or network and/or other network information that pertains to the transmission of content from the network. However, as described below, BGP information mainly describes routes used by the network <NUM> to connect to external networks or customers (such as border networks <NUM>, <NUM>) while IGP information describes routes through the network to connect one edge device (such as gateway <NUM>) to another edge device (such as gateway <NUM>) through a telecommunications network <NUM>.

One or more of the components of the network <NUM> may announce through a BGP session or other routing protocol announcement or advertisement routes serviced by that component. For example, gateway <NUM> may provide a BGP announcement to other components in the network <NUM> that indicates which networks or devices (such as device <NUM>) that may be accessed through the gateway. Thus, the BGP announcement for gateway <NUM> may include a path and next-hop information that designates a path along which packets may be transmitted or received from the connected device <NUM>. The next-hop information generally identifies a particular device of the network <NUM> through which a destination device or address is available. For example, a particular Internet Protocol (IP) address associated with border network <NUM>,<NUM> may be announced from gateway <NUM> to other components of the network <NUM>. Although discussed herein as BGP announcements or advertisements, it should be appreciated that the routing protocol advertisements may be either or both BGP routes between networks and IGP routes through IP network <NUM>.

As mentioned above, the scrubbing architecture <NUM> of the network <NUM> may include a plurality of tiered scrubbing devices to provide scrubbing services for border networks <NUM>,<NUM> or devices <NUM> connected to the network <NUM>. <FIG> is a block diagram <NUM> illustrating the scrubbing architecture <NUM> and orchestrator <NUM> of the network <NUM> of <FIG>. Although illustrated in <FIG> as being included in network <NUM>, the orchestrator <NUM> and/or the scrubbing architecture <NUM> (or portion of the scrubbing architecture <NUM>) may be separate from the network <NUM>.

The scrubbing architecture <NUM> illustrated includes two tiers of scrubbing devices; a first tier <NUM> of large scrubbers <NUM>-<NUM> and a second tier <NUM> of small scrubbers <NUM>-<NUM>. In general, the large scrubbers <NUM>-<NUM> and the small scrubbers <NUM>-<NUM> may provide the same scrubbing service to traffic received at the scrubber. The designations of "large" and "small" may therefore refer to other aspects of the scrubbing devices. For example, a large scrubber <NUM>-<NUM> may be configured with a larger bandwidth of incoming traffic, larger memory, greater computational or processing power, etc. than compared to the small scrubber <NUM>-<NUM>, although any scrubber may provide scrubbing services to received traffic. In other examples, the large scrubbers <NUM>-<NUM> may be more costly when compared to small scrubbers <NUM>-<NUM> due to the higher bandwidth capacity of the large scrubber and may, in some instances, may consume a larger footprint in a networking site of the network <NUM>. In general, as used herein, the designation of a large scrubber <NUM>-<NUM> indicates a scrubber device with a larger incoming bandwidth than compared to the small scrubber <NUM>-<NUM>.

Although illustrated as two tiers of scrubbing devices, the scrubbing architecture <NUM> may include any number of tiers of scrubbing devices. Each tier of the scrubbing architecture <NUM> may include scrubbing devices that differ in some aspect from scrubbers of other tiers in the architecture <NUM>. For example, a first tier may include scrubbers with <NUM> gigabytes per second (Gbps) of bandwidth, a second tier may include scrubbers with <NUM> Gbps of bandwidth, and a third tier may include scrubbers with <NUM> Gbps of bandwidth. Some tiers of the scrubbing architecture <NUM> may include scrubbers with larger memory space in comparison to other scrubbers of the architecture <NUM> to store scrubbing profiles (discussed in more detail below), scrubbers with more processing power than other tiers of scrubbing devices, and the like. In still further examples, one or more tiers of the architecture <NUM> may include scrubbers of various types such that a tier may include scrubbers with large bandwidth and scrubbers with smaller bandwidths. The number of tiers of the architecture <NUM> and the type of scrubbing devices included in each tier may vary from network to network and may be configured by a network administrator.

The operation of the scrubbing devices (the large scrubbers <NUM>-<NUM>, the small scrubbers <NUM>-<NUM>, or any other scrubbing devices with particular capabilities) are described with relation to <FIG>. In particular, <FIG> provides an exemplary network environment <NUM> for providing scrubbing services to traffic during a DDOS attack on one or more components or devices associated with the network <NUM>. In general, the components of the network environment <NUM> may be incorporated or included in the IP network <NUM> of <FIG>. For example, so-called "dirty" router <NUM>, scrubbing architecture <NUM>, so-called "clean" router <NUM>, and orchestrator <NUM> may be included in the network <NUM> as part of a scrubbing or anti-attack service provided by the network <NUM>. Although illustrated in <FIG>, it should be appreciated that more or fewer components than those shown may also be included in the telecommunications network <NUM>. Other components, such as customer device <NUM> and/or Internet <NUM> may form a portion of the network <NUM> or may be included in other communication networks. Regardless of the configuration, the network environment <NUM> of <FIG> provides for a scrubbing service to networks or devices associated with the network <NUM> during a DDOS attack to mitigate the negative effects of the attack on the destination devices <NUM>.

As shown in <FIG>, destination device <NUM> may connect to the Internet <NUM> through a scrubbing device, such as small scrubbing device <NUM>. In general, destination device <NUM> may be any network device, such as an application server or storage server for providing data or any other type of content to requestors through the Internet <NUM>. Further, destination device <NUM> may be more than one customer network device to create a customer network of such devices for providing Internet data or content to requesting devices. The scrubbing architecture <NUM> may provide scrubbing services for all traffic intended for the destination device <NUM>. For example, traffic from the Internet <NUM> intended for the destination device <NUM> may pass through the scrubbing environment <NUM> of <FIG> to remove potentially harmful communications associated with a DDOS attack from reaching the destination device <NUM>. In one instance, an administrator of the destination device <NUM> or destination network may employ a scrubbing service provided by an IP network <NUM> to scrub out communication packets intended for the destination device <NUM> that are identified as malicious or otherwise part of the DDOS attack.

In one particular implementation of the scrubbing service of the network <NUM>, the redirecting of communication packets through the scrubbing architecture <NUM> may be instigated through a BGP announcement or other routing protocol announcement. In particular, the destination device <NUM> or network may provide an IP address associated with the device to the network <NUM> and other connected networks through one or more BGP announcements. Traditionally, BGP announcements are provided by devices or networks to aid networks in creating routing paths to the announcing device. To generate a scrubbing of the traffic for the destination device <NUM>, a Virtual Private Network (VPN) <NUM> associated with the network <NUM> may be created from which the BGP announcements for the destination device <NUM> may be announced. In this manner, the VPN <NUM> acts as a border network between destination device <NUM> and the network <NUM> hosting the scrubbing architecture <NUM>. The routing information announced by the destination device <NUM> to VPN <NUM> may propagate through other components of the network <NUM> through other BGP sessions, such as between VPN <NUM> to clean router <NUM>, from clean router to scrubbing architecture <NUM>, from scrubbing architecture to dirty router <NUM>, and from dirty router <NUM> to the Internet <NUM> public network. This cascading route announcement from destination device <NUM> through the scrubbing architecture <NUM> creates a routing path to reach destination device <NUM> while providing scrubbing services on the traffic intended for the device. Thus, route <NUM> creates a bypass route for communication packets intended for the destination device <NUM> that are now routed through the dirty router <NUM> to begin the scrubbing service of the packets.

Upon routing of traffic intended for the destination device <NUM> along communication line <NUM>, the dirty router <NUM> may transmit the communication packets for the destination device <NUM> to the scrubbing architecture <NUM> for analysis and scrubbing. In particular, the scrubbing architecture <NUM>, as illustrated in <FIG>, may include one or more large scrubbing devices <NUM>-<NUM>, one or more small scrubbing device <NUM>-<NUM>, and/or one or more additional scrubbing devices arranged in a tiered manner based on the capabilities of the scrubbing devices, such as input bandwidth. Three scrubbing devices (large scrubber SD-A <NUM> and small scrubbers SD-B <NUM> and SD-C <NUM>) are illustrated in the example of <FIG>, although more or fewer scrubbers may be included in the scrubbing architecture <NUM>. In some examples, a scrubbing controller <NUM> may also be included to control configurations of the scrubbing devices of the architecture <NUM>. In other examples, the activities or operations of the controller <NUM> may be performed by the orchestrator <NUM> and/or the scrubbing devices, as described in more detail below.

In general, the scrubbing devices of the architecture <NUM> analyze communication packets to determine if such packets may be potentially malicious to a destination device, such as by being part of a DDOS attack, and remove or reroute such packets before reaching the destination device <NUM>. As explained in more detail below, the scrubbing controller <NUM> and/or the orchestrator <NUM> may control the operation of the scrubbing devices of the architecture <NUM>, such as configuring the scrubbing devices with scrubbing profiles that instructs the scrubbing devices on the scrubbing services to apply to received packets. The incoming stream of communication packets for the destination device <NUM> that is scrubbed in the scrubbing architecture <NUM> may then be transmitted to the clean router <NUM> which provides the cleaned stream of packets to the VPN <NUM> over connection <NUM>. The VPN <NUM>, in turn, transmits the cleaned stream of packets to the destination device <NUM> for processing by the device. In this manner, a scrubbing of the communication packets for destination device <NUM> may be provided through the scrubbing architecture <NUM> to mitigate a DDOS attack on the destination device.

The scrubbing devices of the scrubbing architecture <NUM> may be provided with or otherwise have access to scrubbing information that includes IP addresses associated with the destination device <NUM> or network, the type of scrubbing technique to apply to packets with the IP address, and other information that may configure the operation of the scrubbing devices to provide the scrubbing service. This information may be provided to the scrubbing controller <NUM> and/or scrubbers by the orchestrator <NUM>. In some instances, the orchestrator <NUM> may receive or access the scrubbing information or profiles from a database <NUM>. Further, in some instances, the orchestrator <NUM> may be included in the network <NUM> to automate the provisioning of the scrubbers of the scrubbing architecture <NUM> or to adjust the configuration of the scrubbing architecture, as described in more detail below with reference to <FIG>. In general, the orchestrator <NUM> may be any type of computing or networking device, such as an application server. In one implementation, the orchestrator <NUM> receives one or more route protocol advertisements from network devices (such as the BGP route advertisement of the destination device <NUM> received at the clean router <NUM>) and configures one or more of the scrubbing devices or scrubbing controller <NUM> of the scrubbing architecture <NUM> based on the received route protocol advertisement. This configuration of the scrubbing architecture <NUM> may occur automatically in response to the received route information such that the scrubbing service may be provided faster and without manual entry of customer information to the scrubbing environment.

To describe the operation and use of the orchestrator <NUM>, reference is now made to the method <NUM> of <FIG> is a flowchart illustrating a method <NUM> for utilizing a multi-tiered scrubbing architecture <NUM> of a network <NUM> to provide scrubbing services in response to a potential DDOS attack on a device or network associated with the architecture. In general, the operations of the method <NUM> may be performed by the orchestrator <NUM> device discussed above. However, one or more of the operations may be performed by other networking or computing devices, such as a scrubbing device or scrubbing controller. Further, the orchestrator <NUM> may include more than one device for executing the operations of the method <NUM>. Through the method <NUM>, the orchestrator <NUM> may configure one or more aspects of the scrubbing architecture <NUM> to respond to a detected DDOS attack and provide scrubbing services for traffic affected by the attack.

Beginning in operation <NUM>, the orchestrator <NUM> may distribute a scrubbing profile associated with the destination device <NUM> requesting the scrubbing services to one or more small scrubbers <NUM>-<NUM> of the scrubbing architecture <NUM>. As mentioned above, the scrubbing profile may include an identification of one or more IP addresses or a range of IP addresses for which a scrubbing service is to be applied. The profile may include additional information, such as the level of scrubbing, thresholds and rules for detecting a harmful communication packet, actions to take upon detecting a harmful communication packet, a customer identifier associated with the IP addresses for scrubbing, and the like. In some instances, the orchestrator <NUM> may obtain the profile from a database <NUM> in communication with the orchestrator and may retain some aspects of the profile while providing other aspects of the profile to the one or more small scrubber <NUM>-<NUM>.

Using the environment <NUM> of <FIG> as an example, the orchestrator <NUM> may provide the profile to one or more of the small scrubbers <NUM>-<NUM> of the scrubbing architecture <NUM> of the network <NUM>. In one example, the profile is provided to one small scrubbing device (such as small scrubber <NUM>) of the architecture <NUM>. Further, the orchestrator <NUM> may execute one or more rules to determine which small scrubber <NUM>-<NUM> of the architecture <NUM> to provide the profile. In one instance, the determined small scrubber <NUM> to receive the profile may be based on a geographic location of the small scrubber <NUM> in relation to the destination device <NUM> to receive the scrubbed traffic. Providing the profile to a small scrubber <NUM> geographically near the destination device <NUM> may shorten the transmission path between the small scrubber <NUM> and the destination device <NUM> to reduce latency in the scrubbing process. In another example, the orchestrator <NUM> may provide the profile to a plurality of small scrubbers <NUM>-<NUM> of the architecture <NUM> such that any of the small scrubbers may provide the scrubbing service for the destination device <NUM>.

In response to receiving the profile of the destination device <NUM> or network, the small scrubber <NUM> may announce, via a BGP session, one or more IP addresses associated with the destination device <NUM> or network. By announcing the IP addresses, the small scrubber <NUM> may begin receiving packets intended for the destination device <NUM>, as described above. The transmission of the packets to the small scrubber <NUM> may occur regardless of a detected DDOS attack on the destination device <NUM>. Rather, all traffic intended for the destination device <NUM> may be scrubbed by the small scrubber <NUM> as a precaution against undetected DDOS attacks. However, because the traffic intended for the destination device <NUM> during times of no DDOS attack may be small or known, the bandwidth of the small scrubber <NUM> may be less than scrubbing devices of other tiers of the scrubbing architecture <NUM>. In other words, as input bandwidth to the scrubber may remain steady during periods outside of a DDOS attack, the input bandwidth to the small scrubber <NUM> may be less than during periods of a DDOS attack.

In instances where each small scrubber <NUM>-<NUM> receives the profile from the orchestrator <NUM>, each receiving scrubber may announce the IP addresses identified in the profile. This may be an example of an Anycast address in which multiple devices of a network <NUM> announce the same IP addresses. In an Anycast network, the devices of the network may be configured to select the shortest possible routes between devices such that the small scrubber <NUM> that is closest geographically to the destination device <NUM> may receive the traffic intended for the destination device <NUM>. Destination devices or networks located in other areas may receive traffic from other small scrubbers <NUM>-<NUM> of the architecture <NUM> that are closest geographically to the destination device <NUM>.

The small scrubbers <NUM>-<NUM> of the architecture <NUM> may therefore provide "always on" scrubbing services for devices or networks connected to IP network <NUM>. These small scrubbers <NUM>-<NUM> clean or otherwise respond to packets identified as attack packets such that the destination device or network do not receive the packet. The identification of attack packets and the mitigating response to the detection may be determined by the profile provided to the small scrubbers <NUM>-<NUM>. At some point, a DDOS attack against a device or network associated with the IP network <NUM> may occur. To determine the occurrence of a DDOS attack, the small scrubbers <NUM>-<NUM> or other network devices may provide traffic data to the orchestrator <NUM> in operation <NUM>. The traffic data may include volume or bandwidth of the traffic intended for the destination device <NUM> or networks connected to the IP network <NUM>. Other traffic or network metrics may also be provided to the orchestrator <NUM> from other network sources from which the orchestrator <NUM> may determine if a DDOS attack is occurring.

In operation <NUM>, the orchestrator <NUM> may determine if a DDOS attack is occurring to a destination device <NUM> associated with the IP network <NUM>. In one example, this determination may be based on traffic data, such as an increase in traffic bandwidth for the destination device <NUM> above a threshold value of traffic flow to the destination device <NUM> may cause the orchestrator <NUM> to determine that a DDOS attack is occurring. For example, traffic for the destination device <NUM> exceeding <NUM> MB/second may indicate a DDOS attack. Other threshold values may also be considered, such as duration of the traffic exceeding the threshold, rate of change in traffic, percentage increase from a baseline data rate for the destination, etc. In addition, threshold values may vary from destination to destination, such as being one value for a first destination device <NUM> and a second value for a network connected to the IP network <NUM>. Regardless of the network data utilized to determine a DDOS attack may be occurring, the orchestrator <NUM> may return to operation <NUM> and continue to access or receive network data when a DDOS attack is not occurring. The small scrubber <NUM> may continue to scrub the destination device <NUM> traffic during this period.

If the orchestrator <NUM> determines that a DDOS attack may be occurring based on the network data, the orchestrator <NUM> may, in operation <NUM>, identify the IP addresses associated with the detected attack. For example, a network under attack may include several IP addresses, either in a contiguous range or in an non-contiguous range. The orchestrator <NUM> may, based on an analysis of the network data, determine which IP addresses may be under attack. This determination may be made based on which destination IP addresses have an increase in traffic that exceeds the threshold value discussed above. The data received from the small scrubbers <NUM>-<NUM> may thus include the destination IP address for received packets such that the orchestrator <NUM> may identify the metrics for the various incoming communication packets.

In operation <NUM>, the orchestrator <NUM> may distribute the scrubbing profile associated with the attacked IP addresses to a large scrubber <NUM>-<NUM> or other tier of the scrubbing architecture <NUM>. As above, the large scrubber <NUM> may announce, in a BGP session or other address announcement, the attacked IP addresses of the destination device <NUM> to begin receiving the traffic intended for the destination device <NUM>. In addition, the orchestrator <NUM> may instruct one or more of the small scrubbers <NUM>-<NUM> to cease announcing the attacked IP addresses such that the small scrubbers <NUM>-<NUM> stop receiving the traffic for the destination device <NUM>. In this manner, the traffic for the attacked IP addresses of the destination device <NUM> may be transferred from a small scrubber <NUM> to a large scrubber <NUM>, as illustrated in <FIG> as traffic during a detected attack may be scrubbed by large scrubber <NUM> and traffic during a period before or after the detected attack may be scrubbed by small scrubber <NUM>. The large scrubber <NUM> may be configured with a larger input bandwidth than the small scrubber <NUM> to accommodate the large volume of incoming traffic for destination device <NUM> during a DDOS attack.

Although not illustrated herein, the scrubbing architecture <NUM> may include other tiers that correspond to other threshold values such that traffic for the destination device <NUM> may be transferred to a tier based on the threshold value associated with the tier. In this manner the traffic for the destination device <NUM> may move up the tiers of the architecture <NUM> to scrubbing devices with larger and larger input bandwidths to accommodate larger and larger incoming attacks. Further, in one instance, the large scrubbers <NUM>-<NUM> (or any other scrubber of the architecture <NUM>) may be geographically located near known originations of DDOS attacks. For example, several DDOS attacks on the network <NUM> may originate from a particular network or country. A larger scrubber <NUM>-<NUM> may be located within the network <NUM> near the ingress of the origin of the DDOS attacks to minimize or otherwise shorten the route the attack packets take through the network <NUM>. Placement of the large scrubbers <NUM>-<NUM> near the ingress points of the origin of the attack may therefore reduce the impact of the attack on the network <NUM> (by shortening the duration such packets are transmitted through the network <NUM>) in addition to scrubbing the attack from reaching the destination device <NUM>.

Analyzing the traffic for packets intended for the destination device <NUM> or destination network may therefore cause the traffic to be redirected from the small scrubber <NUM> to the large scrubber <NUM>. As the bandwidth requirement to handle incoming traffic during a DDOS attack may be larger than periods when an attack is not occurring, the large scrubber <NUM> may be configured with a larger input bandwidth than the input bandwidth of the small scrubber <NUM>. The large scrubber <NUM> may also include other performance capabilities (such as larger memory and processing capabilities) that improve the scrubbing performance of the large scrubber <NUM> in comparison to the small scrubber <NUM>. Further, the redirection of the incoming traffic for the destination device <NUM> from the small scrubber <NUM> to the large scrubber <NUM> may occur in response to a network performance metric associated with the incoming traffic stream, such as a bandwidth threshold value measured in bytes per second. Thus, as the flow of traffic to the destination device <NUM> increases due to a DDOS attack on the destination device, the scrubbing services may transition from the small scrubber <NUM> to the large scrubber <NUM> to ensure that the scrubbing services is not overwhelmed by the increase in incoming traffic. Multiple tiers of scrubbers may be included in the scrubbing architecture <NUM> to accommodate various threshold levels of incoming traffic to the destination device <NUM> or network.

In operation <NUM>, the orchestrator <NUM> may continue to monitor the traffic intended for the destination device <NUM> or network. As above, the network data associated with the destination device <NUM> may be received from the scrubbers of the scrubbing architecture <NUM> or from another source of the network <NUM> configured to provide traffic data to the orchestrator <NUM>. In operation <NUM>, the orchestrator <NUM> may determine if the DDOS attack on the destination device <NUM> is continuing or has ended. In one instance, the orchestrator <NUM> may determine that the DDOS attack as ended when the traffic for the destination device <NUM> has dropped below the threshold value that triggered transferring the traffic to the large scrubber <NUM>. In another instance, the threshold value of the network metric for determining the DDOS attack has ended may be different than the threshold value for determining a DDOS attack has started. Regardless of the threshold value used, the orchestrator <NUM> may return to operation <NUM> to monitor the traffic intended for the destination device <NUM> during the occurrence of the DDOS attack.

When the orchestrator <NUM> determines that the DDOS attack has ended or the traffic intended for the destination device <NUM> has otherwise dropped below a network metric threshold value, the orchestrator <NUM> may distribute the scrubbing profile associated with the attacked IP addresses to the small scrubber <NUM> or other tier of the scrubbing architecture <NUM>. As above, the small scrubber <NUM> may again announce, in a BGP session or other address announcement, the IP addresses of the destination device <NUM> to receive the traffic intended for the destination device <NUM>. In addition, the orchestrator <NUM> may instruct one or more of the large scrubbers <NUM>-<NUM> to cease announcing the attacked IP addresses of the destination device <NUM> such that the large scrubbers <NUM>-<NUM> stop receiving the traffic for the destination device <NUM>. In this manner, the traffic for the IP addresses of the destination device <NUM> may be returned to the small scrubbers <NUM>-<NUM> of the architecture <NUM> for scrubbing by the small scrubbers <NUM>-<NUM>.

Through the method <NUM> described above, traffic intended for the destination device <NUM> may be scrubbed by a small scrubbing device <NUM>-<NUM> during periods of normal operation or before or after a DDOS attack on the device <NUM>. However, during a detected DDOS attack, traffic for the destination device <NUM> may be transferred to the large scrubber <NUM>-<NUM> with a relatively larger input bandwidth and or other performance capabilities. The large scrubber <NUM>-<NUM> may scrub the incoming packets during the DDOS attack for the destination device <NUM> or network. After the attack has ceased, the traffic may return to being scrubbed by the small scrubber <NUM>-<NUM>. In a similar manner, other tiers of scrubbing devices may be included in the scrubbing architecture <NUM> to provide a scalable and versatile scrubbing environment for the network <NUM> to provide scrubbing services to devices and/or networks connected to the network.

In another example, a small scrubbing device <NUM>-<NUM> may provide scrubbing services for multiple destination devices <NUM> hosted by the VPN <NUM> or any other networks in communication with the clean router <NUM>. A DDOS attack may occur on more than one of the multiple destination devices simultaneously. Each of the DDOS attacks may not be enough to trigger escalation to the large scrubbers <NUM>-<NUM>. Thus, in some implementations, the small scrubbing devices <NUM>-<NUM> may be configured to analyze traffic intended for multiple destination devices <NUM> to determine a DDOS attack on the multiple devices. Upon detection of an attack on the multiple destination devices, the small scrubbing devices <NUM>-<NUM> may transfer the traffic for the devices under attack to the large scrubbers <NUM>-<NUM> as described above. Thus, in this example, traffic intended for multiple destination devices may be analyzed to detect a possible DDOS attack on the network.

<FIG> is a block diagram illustrating an example of a computing device or computer system <NUM> which may be used in implementing the embodiments of the components of the network disclosed above. For example, the computing system <NUM> of <FIG> may be the orchestrator <NUM> discussed above. The computer system (system) includes one or more processors <NUM>-<NUM>. Processors <NUM>-<NUM> may include one or more internal levels of cache (not shown) and a bus controller or bus interface unit to direct interaction with the processor bus <NUM>. Processor bus <NUM>, also known as the host bus or the front side bus, may be used to couple the processors <NUM>-<NUM> with the system interface <NUM>. System interface <NUM> may be connected to the processor bus <NUM> to interface other components of the system <NUM> with the processor bus <NUM>. For example, system interface <NUM> may include a memory controller <NUM> for interfacing a main memory <NUM> with the processor bus <NUM>. The main memory <NUM> typically includes one or more memory cards and a control circuit (not shown). System interface <NUM> may also include an input/output (I/O) interface <NUM> to interface one or more I/O bridges or I/O devices with the processor bus <NUM>. One or more I/O controllers and/or I/O devices may be connected with the I/O bus <NUM>, such as I/O controller <NUM> and I/O device <NUM>, as illustrated.

I/O device <NUM> may also include an input device (not shown), such as an alphanumeric input device, including alphanumeric and other keys for communicating information and/or command selections to the processors <NUM>-<NUM>. Another type of user input device includes cursor control, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to the processors <NUM>-<NUM> and for controlling cursor movement on the display device.

System <NUM> may include a dynamic storage device, referred to as main memory <NUM>, or a random access memory (RAM) or other computer-readable devices coupled to the processor bus <NUM> for storing information and instructions to be executed by the processors <NUM>-<NUM>. Main memory <NUM> also may be used for storing temporary variables or other intermediate information during execution of instructions by the processors <NUM>-<NUM>. System <NUM> may include a read only memory (ROM) and/or other static storage device coupled to the processor bus <NUM> for storing static information and instructions for the processors <NUM>-<NUM>. The system set forth in <FIG> is but one possible example of a computer system that may employ or be configured in accordance with aspects of the present disclosure.

According to one embodiment, the above techniques may be performed by computer system <NUM> in response to processor <NUM> executing one or more sequences of one or more instructions contained in main memory <NUM>. These instructions may be read into main memory <NUM> from another machine-readable medium, such as a storage device. Execution of the sequences of instructions contained in main memory <NUM> may cause processors <NUM>-<NUM> to perform the process steps described herein. In alternative embodiments, circuitry may be used in place of or in combination with the software instructions. Thus, embodiments of the present disclosure may include both hardware and software components.

A machine readable medium includes any mechanism for storing or transmitting information in a form (e.g., software, processing application) readable by a machine (e.g., a computer). Such media may take the form of, but is not limited to, non-volatile media and volatile media and may include removable data storage media, non-removable data storage media, and/or external storage devices made available via a wired or wireless network architecture with such computer program products, including one or more database management products, web server products, application server products, and/or other additional software components. Examples of removable data storage media include Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc Read-Only Memory (DVD-ROM), magneto-optical disks, flash drives, and the like. Examples of non-removable data storage media include internal magnetic hard disks, SSDs, and the like. The one or more memory devices <NUM> may include volatile memory (e.g., dynamic random access memory (DRAM), static random access memory (SRAM), etc.) and/or non-volatile memory (e.g., read-only memory (ROM), flash memory, etc.).

The description above includes example systems, methods, techniques, instruction sequences, and/or computer program products that embody techniques of the present disclosure. However, it is understood that the described disclosure may be practiced without these specific details. In the present disclosure, the methods disclosed may be implemented as sets of instructions or software readable by a device. Further, it is understood that the specific order or hierarchy of steps in the methods disclosed are instances of example approaches. Based upon design preferences, it is understood that the specific order or hierarchy of steps in the method can be rearranged while remaining within the disclosed subject matter. The accompanying method claims present elements of the various steps in a sample order, and are not necessarily meant to be limited to the specific order or hierarchy presented.

It is believed that the present disclosure and many of its attendant advantages should be understood by the foregoing description, and it should be apparent that various changes may be made in the form, construction, and arrangement of the components without departing from the disclosed subject matter or without sacrificing all of its material advantages. The form described is merely explanatory, and it is the intention of the following claims to encompass and include such changes.

Claim 1:
A method for providing a scrubbing service from a network (<NUM>), the method comprising:
receiving (<NUM>), from an orchestrator of the network and at one of a plurality of scrubbing devices (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>) of a scrubbing environment (<NUM>), a scrubbing profile associated with a device (<NUM>) of a telecommunications network, the scrubbing profile comprising an Internet Protocol, IP, address associated with the device;
in response to receiving the scrubbing profile, announcing, by the one scrubbing device via a Border Gateway Protocol, BGP, announcement session, the IP address associated with the device;
determining (<NUM>), by the orchestrator, that each of a plurality of denial of service attacks is occurring on the device and whether each said determined attack is larger than a threshold value associated with the one scrubbing device, and
in response to each said determination that an attack is occurring while a said one scrubbing device is instructed to perform said announcing and that the attack is larger than the threshold value associated with that one scrubbing device:
transmitting (<NUM>) by the orchestrator, to another of the plurality of scrubbing devices (<NUM>, <NUM>, <NUM>) of the scrubbing environment, the scrubbing profile for the device (<NUM>) of the telecommunications network;
instructing (<NUM>), by the orchestrator, the one scrubbing device that is instructed to perform the announcing to cease announcing the IP address associated with the device; and
announcing, by the another scrubbing device, the scrubbing profile transmitted by the orchestrator, the announcement through a second routing protocol announcement session,
wherein the another scrubbing device comprises a larger input bandwidth than the one scrubbing device instructed to cease announcing.