Predicted attack detection rates along a network path

Patent metadata

Field	Value
Publication number	US-10038713-B2
Application number	US-201414270759-A
Country	US
Kind code	B2
Filing date	May 6, 2014
Priority date	May 6, 2014
Publication date	Jul 31, 2018
Grant date	Jul 31, 2018

Abstract

In one embodiment, attack detectability metrics are received from nodes along a path in a network. The attack detectability metrics from the nodes along the path are used to compute a path attack detectability value. A determination is made as to whether the path attack detectability value satisfies a network policy and one or more routing paths in the network are adjusted based on the path attack detectability value not satisfying the network policy.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a device in a communication network, attack detectability metrics from routers along a path in the network;
computing, by the device, a path attack detectability value using the attack detectability metrics from the routers along the path, wherein the path attack detectability value quantifies how well one or more attack detectors executed by the routers along the path are able to detect an attack along the path;
determining, by the device, that the path attack detectability value does not satisfy a network policy; and
adjusting, by the device, one or more routing paths in the network based on the path attack detectability value not satisfying the network policy, wherein the adjusted one or more routing paths guarantee that an attack along the adjusted one or more routing paths is detected at or above a predefined success rate,
wherein the attack detectability metrics are based on recall values for machine learning processes executed by the routers along the path, wherein the machine learning processes are configured to detect the presence of a network attack.

2. The method as in claim 1 , wherein the network policy includes a specified type of traffic, and wherein the path attack detectability value is associated with the type of traffic.

3. The method as in claim 2 , further comprising:
computing, by the device, a second path attack detectability value for a second type of traffic.

4. The method as in claim 3 , further comprising:
instructing, by the device, a particular router in the network to route traffic of the first type along a first route and traffic of the second type along a second route.

5. The method as in claim 1 , wherein adjusting the one or more routing paths comprises:
computing a new routing topology for the network.

6. The method as in claim 1 , wherein adjusting the one or more routing paths comprises:
providing an instruction to a particular router in the network to route traffic along a particular route.

7. The method as in claim 1 , further comprising:
providing, by the device, a notification that no paths in the network have attack detectability values that satisfy the network policy.

8. The method as in claim 1 , wherein the attack detectability metrics are received from the routers along the path via routing protocol messages.

9. An apparatus, comprising:
one or more network interfaces to communicate with a communication network;
a processor coupled to the network interfaces and adapted to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
receive attack detectability metrics from routers along a path in the communication network;
compute a path attack detectability value using the attack detectability metrics from the routers along the path, wherein the path attack detectability value quantifies how well one or more attack detectors executed by the routers along the path are able to detect an attack along the path;
determine that the path attack detectability value does not satisfy a network policy; and
adjust one or more routing paths in the network based on the path attack detectability value not satisfying the network policy, wherein the adjusted one or more routing paths guarantee that an attack along the adjusted one or more routing paths is detected at or above a predefined success rate,
wherein the attack detectability metrics are based on recall values for machine learning processes executed by the routers along the path, wherein the machine learning processes are configured to detect the presence of a network attack.

10. The apparatus as in claim 9 , wherein the network policy includes a specified type of traffic, and wherein the path attack detectability value is associated with the type of traffic.

11. The apparatus as in claim 10 , wherein the process when executed is further operable to:
compute a second path attack detectability value for a second type of traffic.

12. The apparatus as in claim 11 , wherein the process when executed is further operable to:
instruct a particular router in the network to route traffic of the first type along a first route and traffic of the second type along a second route.

13. The apparatus as in claim 9 , wherein the one or more routing paths are adjusted by:
providing an instruction to a particular router in the network to route traffic along a particular route.

14. The apparatus as in claim 9 , wherein the one or more routing paths are adjusted by:
computing a new routing topology for the network.

15. The apparatus as in claim 9 , wherein the process when executed is further operable to:
provide a notification that no paths in the network have attack detectability values that satisfy the network policy.

16. The apparatus as in claim 9 , wherein the attack detectability metrics are received from the routers along the path via routing protocol messages.

17. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:
receive attack detectability metrics from routers along a path in a communication network;
compute a path attack detectability value using the attack detectability metrics from the routers along the path, wherein the path attack detectability value quantifies how well one or more attack detectors executed by the routers along the path are able to detect an attack along the path;
determine that the path attack detectability value does not satisfy a network policy; and
adjust one or more routing paths in the network based on the path attack detectability value not satisfying the network policy, wherein the adjusted one or more routing paths guarantee that an attack along the adjusted one or more routing paths is detected at or above a predefined success rate,
wherein the attack detectability metrics are based on recall values for machine learning processes executed by the routers along the path, wherein the machine learning processes are configured to detect the presence of a network attack.

18. The computer-readable media as in claim 17 , wherein the network policy includes a specified type of traffic, and wherein the path attack detectability value is associated with the type of traffic.

Assignees

• Cisco Tech Inc

Inventors

• Vasseur Jean-Philippe
• Cruz Mota Javier
• Di Pietro Andrea

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1458 Primary

  Denial of Service · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title