Patent ID: 8397284

Claim:
A method for detecting malicious communication traffic at an autonomous network domain comprising: sampling packets of a plurality of flows at each of a plurality of routing nodes in the autonomous network domain, each of said flows including incoming packets having a common source address and outgoing packets having a common destination address; providing in memory at each of said routing nodes an IP-mapped symmetric flow table of counters and an IP-mapped asymmetric flow table of counters, each counter of said IP-mapped symmetric flow table and said IP-mapped asymmetric flow table mapped to at least a portion of a corresponding internet protocol address; providing in said memory at each of said routing nodes a hashed-mapped symmetric flow table of counters and a hashed-mapped asymmetric flow table of counters, each counter of said hash-mapped symmetric flow table and said hash-mapped asymmetric flow table mapped by a hashing function of said internet protocol address; counting at each of said routing nodes said sampled packets into at least one counter mapped to an at least partially randomized distribution of said plurality of flows; updating said counters in said IP-mapped symmetric flow table, said hash-mapped symmetric flow table, said IP-mapped asymmetric flow table and said hash-mapped asymmetric flow table responsive to said sampled packets in said counting step; aggregating at each of said routing nodes said IP-mapped symmetric flow table and said hash-mapped symmetric flow table of others of said routing nodes; adding at each of said routing nodes said counters of said aggregated IP-mapped symmetric flow table to corresponding said counters in said IP-mapped asymmetric flow table and said counters of said aggregated hash-mapped symmetric flow value to said hash-mapped asymmetric flow table; determining at each of said routing nodes a residual count of said outgoing packets exceeding said incoming packets; transmitting said count from each of said routing nodes to at least one rendezvous node; aggregating at said rendezvous node said IP-mapped asymmetric flow table and said hash-mapped asymmetric flow table from said routing nodes; and determining at said at least one rendezvous node at least one flow identifier of an attack flow by determining from said aggregated IP-mapped asymmetric flow table and said aggregated hash-mapped asymmetric flow table at said rendezvous node said attack flow.