Mitigating reflection-based network attacks

Patent metadata

Field	Value
Publication number	US-9813314-B2
Application number	US-201414336106-A
Country	US
Kind code	B2
Filing date	Jul 21, 2014
Priority date	Jul 21, 2014
Publication date	Nov 7, 2017
Grant date	Nov 7, 2017

Abstract

In one embodiment, a network device routes traffic along a network path and receives a performance threshold crossing alert regarding performance of the network path. The network device detects that the performance threshold crossing alert is part of a potential network attack by analyzing, by the device, the performance threshold crossing alert. The network device also provides a notification of the detected network attack.

First claim

What is claimed is:

1. A method, comprising:
routing, by a network device, traffic along a network path;
receiving, at the network device, a performance threshold crossing alert regarding performance of the network path;
detecting that the performance threshold crossing alert is part of a potential network attack by analyzing, by the network device, the performance threshold crossing alert, wherein the detection distinguishes performance threshold crossing alerts from legitimate entities from performance threshold crossing alerts from malicious entities;
providing, by the network device, a notification of the detected network attack;
generating, by the network device, one or more keys and one or more seed values;
performing, by the network device, handshaking with a second network device located along the network path by exchanging keys and seed values;
receiving, at the network device, a performance threshold crossing alert from the second network device, wherein the alert from the second network device is digitally signed using a particular key generated using the exchanged seed values; and validating, by the network device, the alert from the second network device received from the second network device using one of the exchanged keys.

2. The method as in claim 1 , wherein detecting that the performance threshold crossing alert is part of a potential network attack comprises:
predicting, by the network device, a probability of receiving the performance threshold crossing alert, wherein the potential network attack is detected based on the predicted probability of receiving the performance threshold crossing alert.

3. The method as in claim 1 , wherein the performance threshold crossing alert correspond to an amount of jitter or delays along the network path.

4. The method as in claim 1 , wherein detecting that the performance threshold crossing alert is part of a potential network attack comprises:
sending, by the network device, one or more measurement probe packets along the network path;
receiving, at the network device, path characteristics identified from the sent one or more probe packets; and
comparing, by the network device, the path characteristics to the alert.

5. The method as in claim 1 , wherein detecting that the performance threshold crossing alert is part of a potential network attack comprises:
sending, by the network device, a packet that identifies the traffic and does not have a payload to a second device located along the network path; and
receiving, from the second device, a notification that confirms that the alert is part of an attempted attack.

6. The method as in claim 1 , wherein detecting that the performance threshold crossing alert is part of a potential network attack comprises:
querying, by the network device, whether the performance threshold crossing alert was also received by a second network device, wherein the second network device routes traffic along a second network path; and
receiving, from the second device, a notification that confirms that the alert is part of an attempted attack.

7. The method as in claim 1 , wherein detecting that the performance threshold crossing alert is part of a potential network attack comprises:
providing the threshold crossing alert to a user interface device; and
receiving, from the user interface device, a notification that confirms that the alert is part of an attempted attack.

8. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
route traffic along a network path;
receive a performance threshold crossing alert regarding performance of the network path;
detect that the performance threshold crossing alert is part of a potential network attack by analyzing the performance threshold crossing alert, wherein the detection distinguishes performance threshold crossing alerts from legitimate entities from performance threshold crossing alerts from malicious entities;

provide a notification of the detected network attack;
generate one or more keys and one or more seed values;
perform handshaking with a second network device located along the network path by exchanging keys and seed values;
receive a performance threshold crossing alert from the second network device, wherein the alert from the second network device is digitally signed using a particular key generated using the exchanged seed values; and
validate the alert from the second network device received from the second network device using one of the exchanged keys.

9. The apparatus as in claim 8 , wherein the potential network attack is detected by:
predicting a probability of receiving the performance threshold crossing alert, wherein the potential network attack is detected based on the predicted probability of receiving the performance threshold crossing alert.

10. The apparatus as in claim 8 , wherein the performance threshold crossing alert corresponds to an amount of jitter or delays along the network path.

11. The apparatus as in claim 8 , wherein the potential network attack is detected by:
sending one or more measurement probe packets along the network path;
receiving path characteristics identified from the sent one or more probe packets; and
comparing the path characteristics to the performance threshold crossing alert.

12. The apparatus as in claim 8 , wherein the potential network attack is detected by:
sending a packet that identifies the traffic and does not have a payload to a second device located along the network path; and
receiving, from the second device, a notification that confirms that the performance threshold crossing alert is part of an attempted attack.

13. The apparatus as in claim 8 , wherein the potential network attack is detected by:
querying whether the performance threshold crossing alert was also received by a second network device, wherein the second network device routes traffic along a second network path; and
receiving, from the second device, a notification that confirms that the alert is part of an attempted attack.

14. The apparatus as in claim 8 , wherein the potential network attack is detected by:
providing the threshold crossing alert to a user interface device; and
receiving, from the user interface device, a notification that confirms that the alert is part of an attempted attack.

15. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:
route traffic along a network path;
receive a performance threshold crossing alert regarding performance of the network path;
detect that the performance threshold crossing alert is part of a potential network attack by analyzing the performance threshold crossing alert, wherein the detection distinguishes performance threshold crossing alerts from legitimate entities from performance threshold crossing alerts from malicious entities;
provide a notification of the detected network attack;
generate one or more keys and one or more seed values;
perform handshaking with a second network device located along the network path by exchanging keys and seed values;
receive a performance threshold crossing alert from the second network device, wherein the alert from the second network device is digitally signed using a particular key generated using the exchanged seed values; and
validate the alert from the second network de

Assignees

• Cisco Tech Inc

Inventors

• Vasseur Jean-Philippe
• Dasgupta Sukrit

Classifications

• H04L63/00

  Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00) · CPC title

• H04L12/2854 Primary

  Wide area networks, e.g. public data networks · CPC title

• H04L43/062 Primary

  related to network traffic · CPC title

• H04L43/0852

  Delays · CPC title

• H04L43/16

  Threshold monitoring · CPC title