Patent ID: 6880090

Claim:
In a multicast capable Internet Protocol (IP) network comprising a plurality of interconnected routers, wherein specified ones of said plurality of interconnected routers each communicate with a decoy forwarding server (DFS) and a protected site router (PSR), and wherein said PSR is connected via a local are network (LAN) to a multicast receiver server (MRS) and a protected site server host (PSSH), a method of protecting against a coordinated distributed denial of service attack comprising: (a) in standby mode, delivering unicast user traffic to said PSSH via said PSR; and (b) upon detection of said distributed denial of service attack, at a selected one of said specified routers: (i) decoying all traffic received at said specified router to said DFS, said traffic including said unicast user traffic and unicast attack traffic; (ii) filtering said unicast user and attack traffic comprising identifying and discarding said unicast attack traffic; (iii) encapsulating said unicast user traffic using a multicast address hopping protocol and delivering said encapsulated traffic to said MRS; and (iv) de-encapsulating said encapsulated traffic and delivering said de-encapsulated traffic to said PSSH.