Mitigation of path-based convergence attacks

摘要

Technologies are generally described for mitigation of a convergence attack in a network portion that includes multiple nodes interconnected by links in a closed configuration. In some examples, the attack may be detected by a detection module of an attack mitigation system in response to a determination that received average time to live (TTL) values of data packets are substantially decreased over the multiple nodes of the network portion. An identification module of the system may identify one or more potential attack links causing the attack, and generate a list from the potential attack links. The identification module may iterate the list across the potential attack links to gather traffic statistics of the network portion, and determine one or more attack links based on the traffic statistics. User-specific data traffic throttling to the attack links may then be enforced by a throttling module of the system to mitigate the attack.

主权项

1. A method executed at least in part on a computing device to mitigate a convergence attack in a network, the method comprising:
receiving average time to live (TTL) values of one or more data packets from multiple nodes in a portion of the network, wherein the multiple nodes are interconnected by links in a closed configuration; detecting a path-based convergence attack in response to a determination that the average TTL values of the one or more data packets are substantially decreased over the multiple nodes; identifying one or more potential attack links causing the attack in the network portion to generate a list from the identified potential attack links, iterating the list across the one or more potential attack links to gather traffic statistics of the network portion; determining one or more attack links based on the gathered traffic statistics of the network portion; and enforcing data traffic throttling by employing on-flow rate throttling to limit user-specific increases in traffic flow provided to the one or more attack links to mitigate the attack.