University System of Maryland

Mehdi Kalantari Khandani

Mark A Shayman

An estimate of a portion of network traffic that is nonconforming to a communication transmission control protocol is used to signal that a distributed denial of service attack may be occurring. Traffic flows are aggregated and packets are intentionally dropped from the flow aggregate in accordance with an assigned perturbation signature. The flow aggregates are observed to determine if the rate of arrival of packets that have a one-to-one transmission correspondence with the dropped packets are similarly responsive to the perturbation signature. By assigning orthogonal perturbation signatures to different routers, multiple routers may perform the test on the aggregate and the results of the test will be correctly ascertained at each router. Nonconforming aggregates may be redefined to finer granularity to determine the node on the network that is under attack, which may then take mitigating action.

Detection of nonconforming network traffic flow aggregates for mitigating distributed denial of service attacks

In a communication network, the responsiveness of the transmission rate of data packets to packet drops is quantified for an aggregate of flows as opposed to on a per-flow basis. In an Aggregate Perturbation Method (APM), a small number of data packets is intentionally dropped from the aggregate at a switching node and a response thereto is measured. Traffic not conforming to the predetermined transmission control protocol may be discovered as a decrement in the reduction in traffic rate compared to that anticipated based on the rate of dropped packets. To prevent interference from the simultaneous application of APM at multiple switching nodes, an orthogonal drop rate signature defining the instantaneous drop rate is assigned thereto. The orthogonal drop rate signature is based on the code division multiple access (CDMA) coding of data, and for that reason, APM with the application of orthogonal drop rate signatures is termed CDMA-based APM, or CAPM. APM or CAPM may be utilized as a component in fair congestion control or in mitigating distributed denial of service (DDoS) attacks of the Internet.

Growing community of inventors

College Park, MD, United States of America

Mehdi Kalantari Khandani