Mitigating denial of service attacks by leveraging geographical locations of network edges

Abstract

A system analyzes network traffic at the network edge in a Point-of-Presence (POP) to prevent denial of service attacks, such a reflection attack, and filters such attack traffic. The POP can analyze a source identifier of the network traffic, such as a source prefix, and compare the source identifier to known source identifiers from the same geographic region as the POP. If the source identifier is outside of the POPs geographic region, then the network traffic is rate limited, such as by blocking the network traffic or reducing the network traffic to a desired threshold. To further ensure that the traffic is routed to the appropriate POP, the POP edge location announces anycast addresses for receiving the network traffic. The geographic region can be defined as a city, a country, sub-regions within a country, a portion of a continent (e.g., southeast region of Asia), a continent, etc.