System and method for detecting large-scale hostile attacks of data center networks

Abstract

A method and system for detecting massively malicious threats by iteratively aggregating network flow information of received data packets, the method comprising: analyzing the network flow information of the received data packets; allocating a time interval window for time aggregation based on the network flow information; determining a corresponding data center (DC) for DC aggregation based on the network flow destination IP information; determining a corresponding sub-network IP range according to the network flow destination IP information so as to perform sub-network aggregation; and determining a transmission protocol of a server corresponding to the IP subnet. A packet size and / or a packet number for a subnet transport protocol and a server transport protocol is updated based on the received packets. Upon detecting that the updated packet size / number of packets of the subnet or server transport protocol exceeds a predefined threshold, an alert is issued indicating a potential capacity malicious threat.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to European Patent Application No. 24306408, filed on August 28, 2024, entitled “System and method for detecting large-scale malicious attacks on data center networks”, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure generally relates to network traffic engineering analysis of data center networks, and particularly to the detection of large-scale malicious threats on data center networks. Background Technology

[0004] To serve client demands, data center networks must be configured with the necessary resources to handle large volumes of network traffic data in near real-time. Simultaneously, the data center must monitor network traffic flow to detect security and / or performance issues in the network or related network elements.

[0005] Detection of potential malicious threats typically targets Distributed Denial-of-Service (DDoS) attacks, which use a barrage of malicious packets against a specific host / server. However, a different DDoS attack pattern appears to have recently emerged. Instead of bombarding a specific host / server, this attack directly transmits a limited number of malicious packets to multiple servers belonging to a data center network subnet, eventually saturating the corresponding switches / routers. This malicious attack pattern has been described as large-scale or "carpet bombing," and traditional network analysis techniques struggle to detect it.

[0006] Therefore, there is interest in providing a monitoring method capable of detecting malicious threats such as DDoS carpet bombing attacks. Summary of the Invention

[0007] The implementation of this disclosure is based on the developer’s understanding of the shortcomings and problems associated with the current network information flow in terms of the difficulty in detecting large-scale malicious / carpet bombing attacks.

[0008] Therefore, the implementation of this technology is defined by the appended set of claims.

[0009] Therefore, a method for detecting malicious threats by iteratively aggregating network flow information of received data packets is provided. The method includes: analyzing the network flow information of the received data packets; allocating time interval windows based on the network flow information of the received data packets for time aggregation; determining the corresponding data center (DC) based on the network flow destination IP information of the received data packets for DC aggregation; determining the corresponding subnet IP range based on the network flow destination IP information of the received data packets for subnet aggregation; evaluating the transport protocol used for the subnet IP range based on the received data packets and updating the data packet size and / or packet count; determining whether the updated data packet size and / or packet count of the transport protocol used for the subnet IP range exceeds a first predefined threshold; evaluating the transport protocol of the corresponding server for the IP subnet based on the received data packets and updating the data packet size and / or packet count; and determining whether the updated data packet size and / or packet count of the server's transport protocol exceeds a second predefined threshold.

[0010] Furthermore, when it is determined that the updated packet size and / or number of packets contained in the transport protocol used for the subnet IP range exceeds a first predefined threshold, an alarm indicating that a potential threat has been detected is issued; and when it is determined that the updated packet size and / or number of packets contained in the transport protocol used for the server exceeds a second predefined threshold, an alarm indicating that a potential threat has been detected is issued.

[0011] In some aspects, the method additionally includes pre-configuring an additional destination IP address requested by the client by: providing the additional destination IP address requested by the client; performing a database lookup function to identify a previously registered IP address that belongs to the requesting client; associating the additional destination IP address with the database based on the identified previously registered IP address; and registering and storing the additional IP address associated with the requesting client in the database.

[0012] Furthermore, a system for detecting malicious threats by iteratively aggregating network flow information of received data packets is provided. This system includes: a network communication infrastructure configured to: facilitate the transmission of received data packets; and guide received data packets to a intended destination based on a destination IP address identified by the corresponding network flow information of the received data packets; at least one data center (DC) communicating with the network communication infrastructure, the at least one data center (DC) including at least one top-of-rack (ToR) network switch configured to manage multiple servers associated with an IP subnet; a time aggregation layer configured to allocate time interval windows to received data packets based on start and end times identified by the corresponding network flow information; and a DC aggregation layer. The aggregation layer is configured to determine the corresponding DC serving an IP address range containing the destination IP address based on the destination IP address identified by network flow information; the subnet aggregation layer is configured to: determine the IP subnet and associated subnet transport protocol based on network flow information, evaluate the subnet transport protocol based on the network flow information of the received data packets and update the data packet size and / or number of packets, and determine whether the updated subnet transport protocol's data packet size and / or number of packets exceeds a first predefined threshold; and the server aggregation layer is configured to: determine the server corresponding to the IP subnet and associated server transport protocol based on network flow information, evaluate the server transport protocol based on the network flow information of the received data packets and update the data packet size and / or number of packets, and determine whether the updated server transport protocol's data packet size and / or number of packets exceeds a second predefined threshold.

[0013] Furthermore, when the updated packet size and / or number of packets contained in the transport protocol used for the subnet IP range exceeds a first predefined threshold, an alarm indicating the detection of a potential threat is issued; and when the updated packet size and / or number of packets contained in the transport protocol used for the server exceeds a second predefined threshold, an alarm indicating the detection of a potential threat is issued.

[0014] In some aspects, the system additionally includes a future aggregation layer configured to: provide an additional destination IP address requested by the client; perform a database lookup function to identify previously stored registered IP addresses belonging to the requesting client; associate the additional destination IP address with the requesting client based on the identified previously stored registered IP address; and register and store the additional IP address associated with the requesting client in the database.

[0015] It should be understood that additional and / or alternative features, aspects and advantages of the present technology will become apparent from the following description, drawings and appended claims. Attached Figure Description

[0016] Further features and advantages of this disclosure will become apparent from the following detailed description taken in conjunction with the accompanying drawings, wherein:

[0017] Figure 1 A high-level concept diagram depicting a network topology according to an embodiment of the present disclosure is provided.

[0018] Figure 2A , Figure 2B , Figure 2C A functional flow aspect of an aggregated processing architecture for detecting malicious threats according to embodiments of this disclosure is described.

[0019] Figure 3 The embodiments based on this disclosure are described. Figures 2A to 2C Flowchart of a method for detecting malicious threats through aggregation process;

[0020] Figure 4 A flowchart depicts a method for detecting malicious threats in future aggregation according to embodiments of the present disclosure; and

[0021] Figure 5 An exemplary computing environment for implementing and / or performing any of the methods described herein is depicted according to embodiments of this disclosure.

[0022] It should be understood that throughout the drawings and the corresponding description, the same features are identified by the same reference numerals, and the drawings are not drawn to scale. It should also be understood that the drawings and the following description are for illustrative purposes only, and these disclosures are not intended to limit the scope of the claims. Detailed Implementation

[0023] This disclosure aims to address at least some of the shortcomings and problems associated with the difficulty of current network information flow in detecting malicious large-scale / carpet bombing threats or attacks.

[0024] However, it should be understood that the embodiments and conditional language cited herein are primarily intended to help the reader understand the principles of the technology, and not to limit its scope to these specifically cited embodiments and conditions. It should be understood that those skilled in the art can devise various arrangements that, while not explicitly described or shown herein, still embody the principles of the technology and are included within its spirit and scope.

[0025] Furthermore, to aid understanding, the following description illustrates a relatively simplified implementation of the present technology. As those skilled in the art will understand, various implementations of the present technology may be more complex. In some cases, beneficial implementations believed to modify the present technology may also be described. This is done merely to aid understanding and is not intended to limit the scope of the present technology or define its boundaries. These modifications are not an exhaustive list, and those skilled in the art can make other modifications without departing from the scope of the present technology.

[0026] Furthermore, the absence of examples of modifications should not be construed as impossibly impossible or as representing the only way to implement this element of the technology. Thus, all statements herein describing the principles, aspects, and implementations of the technology, and their specific embodiments, are intended to cover both their structural and functional equivalents, whether they are currently known or will be developed in the future.

[0027] Those skilled in the art will understand that any block diagram herein represents a conceptual view of an illustrative circuit embodying the principles of this technology. Similarly, it will be understood that any flowchart, diagram, state transition diagram, pseudocode, etc., represents various processes that can be substantially represented in a non-transitory computer-readable medium and therefore executed by a computer or processor, whether or not such a computer or processor is explicitly shown.

[0028] Similarly, the functionality of the various elements shown in the figure, including any functional blocks labeled "processor," can be provided by using dedicated hardware and hardware capable of executing software in association with appropriate software.

[0029] Additionally, when the phrase “at least one of A and B” is used in the specification and claims, it should be understood that the phrase is intended to mean “only A,” “only B,” or “both A and B.”

[0030] Based on these fundamental principles, the above-described embodiments are non-limiting implementations that illustrate various aspects and implementations of this disclosure.

[0031] Figure 1 A high-level concept diagram of a network topology 100 according to an embodiment of the present disclosure is depicted. As shown, the network topology 100 includes access point (PoP) network devices 102A-102N that provide packet traffic to a network communication infrastructure 104. The network communication infrastructure 104 then directs the packet traffic to the appropriate data center based on the IP destination address of the packet.

[0032] By way of non-limiting illustration, network communication infrastructure 104 is shown directing packet traffic to data centers 106 and 108. Again, for clarity, data centers 106 and 108 are shown as including top-of-rack (ToR) network switching / routing devices 106A and 108A, respectively. The ToR routing devices 106A and 108A are configured to provide packet routing services to a specified IP subnet destination range. The packets are then routed to dedicated network servers 106A1-106AN and 108A1-108AN, respectively, whose destination IP addresses fall within the specified IP subnet destination range. In some embodiments, the specified IP subnet range can each include up to 256 network servers under the routing control of the ToR routing devices 106A and 108A.

[0033] Additionally, data centers 106 and 108 are also shown as including top-of-rack (ToR) routing devices 106B and 108B, respectively, for routing data packets to host network devices 106B1, 106B2, 108B1, and 108B2. These host network devices 106B1, 106B2, 108B1, and 108B2 route data packets to corresponding virtual machines (VMs) 106B1A-106B1N, 106B2A-106B2N, and 108B1A-108B1N, 108B2A-108B2N based on specified destination IP addresses. In some implementations, under the routing control of the ToR routing devices 106B and 108B, the specified IP address can each include up to 256 VMs.

[0034] Furthermore, network topology 100 utilizes a network flow information process that observes traffic-related metadata, such as: for example, source / destination IP addresses, port source / destination, number of packets, total payload size, transmission / reception time, etc., for traffic flowing through network devices (such as switches, routers, hosts, etc.). Network flow information can operate under the NetFlow standard, the SFlow standard, or any suitable network flow-oriented standard capable of conveying network flow information of network devices throughout the network.

[0035] With such network flow information, network topology 100 can calculate the expected bandwidth of specific or range of IP addresses of network devices, and establish and define thresholds for the total size of received data packets and the total number of packets received based on the network capacity and type of the client (i.e., games, internal services, storage, etc.).

[0036] As described above, a "carpet bombing" attack aims to transmit a limited number of malicious packets to a data center network switch / router that serves multiple servers with different individual destination IP addresses under a corresponding IP subnet. Because the number of malicious packets distributed among multiple servers is limited, carpet bombing is difficult to detect using conventional analysis techniques.

[0037] therefore, Figure 2A , Figure 2B , Figure 2C Aspects of the functional flow of an aggregation processing architecture 200 for detecting malicious threats, including DDoS carpet bombing attacks, according to embodiments of the present disclosure are described. As shown, the aggregation processing architecture 200 is a multi-layer aggregation detection architecture configured to aggregate all potential packet threats distributed across multiple servers belonging to an IP subnet to detect DDoS carpet bombing attacks aimed at disabling network routing devices 106A, 108A controlling multiple servers.

[0038] As shown, the aggregation processing architecture 200 includes a time aggregation layer 202, a data center (DC) aggregation layer 204, a subnet aggregation layer 206, a server aggregation layer 208, and a future aggregation layer 210. As will be described in more detail below, the aggregation processing architecture 200 utilizes network flow information to analyze and process newly received packets that have been iteratively accumulated to determine whether the network flow information indicates a metric that exceeds predetermined thresholds for aggregation layers 202, 204, 206, and 208.

[0039] In particular, such as Figure 2A As shown, a new data packet with network flow information is received, wherein the processing architecture 200 determines the start and end times of receipt, the IP destination address, the defined transport protocol, the overall payload data packet size, and the number of discrete packets in the received data packet based on the network flow information. The selection of the new data packet to be received is generally based on network flow information processes, such as sampling or statistical algorithms based on network flow traffic. In the non-limiting example shown, it has been determined that the newly received data packet contains 3 discrete packets, each with a data packet size of 1432 bytes.

[0040] The time aggregation layer 202 of the processing architecture 200 allocates a corresponding predetermined time interval window based on the start and end times of newly received data packets. The time aggregation layer 202 is configured to aggregate traffic data with various time window resolutions (e.g., 100ms, 1,000ms, 10,000ms, etc.). In the non-limiting example shown, the network flow information of the newly received data packet has a start and end time between 8:42 and 8:44, and the time aggregation layer 202 allocates it to the corresponding predetermined time interval window from 8:40 to 8:45.

[0041] After allocating newly received data packets to the appropriate time interval window, the aggregation processing architecture 200 then analyzes the received data packets at the data center (DC) aggregation layer 204. The DC aggregation layer 204 is configured to identify which data center the newly received data packet is directed to based on the IP destination address extracted from relevant network flow information. In a non-limiting illustrative example, the newly received data packet has a destination IP address of 5.135.186.75, which is identified as belonging to data center RBX-2.

[0042] After identifying the corresponding data center, the aggregation processing architecture 200 then analyzes the newly received data packets at the subnet aggregation layer 206. The subnet aggregation layer 206 is configured to determine the corresponding IP subnet destination range and the corresponding ToR routing device, as extracted from relevant network flow information. The subnet aggregation layer 206 also performs transport protocol aggregation for the determined IP subnet destination range. In the non-limiting example shown, the newly received data packet is determined to belong to the IP destination subnet 5.135.186.0 based on the destination IP address 5.135.186.75. Relatedly, the transport protocol aggregation determines that the corresponding protocol is UDP, where prior to the newly received data packet, the data packets transmitted via UDP comprised 8831 packets with a total data size of 52344 bytes, and after receiving the new data packet (e.g., 3 packets with a total size of 1432 bytes), the updated packet metric is 8834 packets with a total size of 53776 bytes.

[0043] At the subnet aggregation layer 206, if it is determined that the updated number of received packets and / or the updated total packet size exceeds a predefined threshold for the corresponding destination subnet 5.135.186.0, the processing architecture 200 sends an alert indicating that a potential threat / attack has been detected. The subnet aggregation layer 206 is configured to iteratively continue updating the accumulated number of packets and packet size to date, and to identify any threshold breaches in future received packets delivered by the same transport protocol (e.g., UDP) for the same corresponding destination subnet (e.g., 5.135.186.0).

[0044] Go to Figure 2B After evaluating and aggregating the destination IPs of the subnets, the aggregation processing architecture 200 moves to the server aggregation layer 208 to analyze the metrics of the transport protocols of the corresponding subnets, starting from the destination IP address 5.135.186.75 of a single server (as extracted from the relevant network flow information), and analyzes the metrics of the transport protocols of a specific single server with the destination IP address 5.135.186.75.

[0045] In the non-limiting example shown, server aggregation layer 208 aggregates subnet transport protocols to determine that the corresponding UDP protocol had already transmitted 413 packets containing a total data size of 10344 bytes before the newly received data packet. After receiving a new data packet (e.g., 3 packets with a total size of 1432 bytes), the updated packet metric is 416 packets with a total size of 11776 bytes. Then, layer 208 aggregates individual server transport protocols to determine that the corresponding UDP protocol had already transmitted 54 packets containing a total data size of 2130 bytes before the newly received data packet. And, after receiving a new data packet, the updated packet metric is 57 packets with a total size of 3562 bytes.

[0046] At the server aggregation layer 208, if it is determined that the number of received packets and / or the total size of received data packets exceeds a defined threshold, the processing architecture 200 sends an alert indicating that a potential threat / attack has been detected.

[0047] Go to Figure 2C The processing architecture 200 also has the capability to provide future aggregation operations and protect additional / alternative IP addresses in the event of IP failover (IPFO). Specifically, the future aggregation layer 210 allows clients to request and obtain additional destination IP addresses that are independent of the client's previously registered IP subnet addresses and can function as failover addresses that can be seamlessly switched between servers. The future aggregation layer 210 employs an IPFO database containing all IPFOs and corresponding clients. Therefore, the future aggregation layer 210 performs access to the IPFO database and performs a "lookup" function to identify which previously registered subnet IP addresses belong to the requesting client. After identifying the client's previously registered subnet IP addresses, the additional IP address is associated with the client and the previously registered subnet IP addresses and registered to the client. The future aggregation layer 210 then returns to the subnet aggregation layer 206 of the processing architecture 200 to continue the layer aggregation process. Therefore, if an attack on the server is detected, all IP addresses corresponding to a specific client will be addressed.

[0048] In this way, the aggregation processing architecture 200 uses network flow information to analyze and process newly received packets accumulated for each layer iteration in order to detect a small number of malicious packets that are spread across multiple servers and eventually saturate the network devices.

[0049] Figure 3 A flowchart of a method 300 for detecting malicious threats based on an aggregation processing architecture 200, according to an embodiment of this disclosure, is depicted. As shown, method 300 begins with task block 302, where the network receives new data packets, and in task block 304, network flow information of the newly received data packets is analyzed in response to traffic-related metadata. Such metadata includes source / destination IP addresses, port source / destination, number of packets, total payload size, transmission / reception time, etc., for traffic across network devices.

[0050] At task block 306, time interval windows are allocated based on network flow time for time aggregation. As described above, time aggregation layer 202 is configured to aggregate packets with various time window resolutions (e.g., 100ms, 1,000ms, 10,000ms, etc.). At task block 308, the corresponding data center (DC) is determined based on the network flow destination IP information for DC aggregation.

[0051] At task block 310, the corresponding subnet IP range is determined based on the network flow destination IP information for subnet aggregation. The subnet IP range is associated with a ToR device that can contain up to 256 individual servers. Subnet aggregation updates the number and size of packets based on newly received data packets. At task block 312, the transport protocol is determined based on the network flow information used for subnet protocol aggregation, and the updated packet number and size are determined based on newly received data packets.

[0052] At decision block 314, method 300 determines whether the updated packet count or total packet size of the protocol aggregation exceeds a threshold for the subnet. If the updated packet count or total packet size of the protocol aggregation exceeds the threshold for the subnet, an alert indicating a potential threat / attack is sent at task block 316. If the updated packet count or total packet size of the protocol aggregation does not exceed the threshold for the subnet, method 300 proceeds to task block 318, where servers belonging to the subnet are analyzed for server aggregation.

[0053] Then, at task block 320, the transport protocols associated with the subnet are analyzed to determine the updated number of packets and the total data packet size of the transport protocol aggregation.

[0054] At decision block 322, method 300 determines whether the updated packet count and total packet size of the transport protocol aggregation exceed a threshold for the server. If the updated packet count and total packet size of the transport protocol aggregation exceed the threshold for the server, an alert indicating a potential threat / attack is detected is sent via task block 316, and method 300 terminates. If the determined packet count or size does not exceed the threshold, method 300 returns to task block 302 to continue iteratively aggregating the size and count of newly received packets at each layer. Figure 4 A flowchart of method 400 according to an embodiment of the present disclosure is depicted, which serves a future aggregation process to detect malicious threats from a client requesting an additional destination IP address. As shown, method 400 begins at task block 402, where method 400 provides an additional destination IP address based on a client request. At task block 404, method 400 performs a lookup function in an IPFO database of previously registered IP addresses belonging to the requesting client.

[0055] At task block 406, based on the lookup function, method 400 associates the additional destination IP address with the requesting client in the IPFO database and registers it. Then, at task block 408, method 400 returns to task block 310 of method 300 for subsequent layer processing to detect malicious packets.

[0056] Figure 5 Exemplary computing environments 500 according to various embodiments of the present disclosure are depicted, which can be used to implement and / or perform any of the methods described herein. In some embodiments, the computing environment 500 may be implemented by any conventional personal computer, network device, and / or electronic device (such as, but not limited to, mobile devices, tablet devices, servers, controller units, control devices, etc.) and / or any combination suitable for the currently relevant task.

[0057] In some implementations, computing environment 500 includes various hardware components, including one or more single-core or multi-core processors represented by processor 510, solid-state drive 520, random access memory 530, and input / output interface 550. Computing environment 500 may be a computer specifically designed to operate machine learning algorithms (MLA). Computing environment 500 may also be a general-purpose computer system.

[0058] In some embodiments, computing environment 500 may also be a subsystem of one of the systems listed above. In some other embodiments, computing environment 500 may be an "off-the-shelf" general-purpose computer system. In some embodiments, computing environment 500 may also be distributed among multiple systems. Computing environment 500 may also be specifically designed to implement this technology. Those skilled in the art will understand that various variations regarding how computing environment 500 can be conceived without departing from the scope of this technology.

[0059] Those skilled in the art will understand that processor 510 generally represents processing power. In some embodiments, one or more dedicated processing cores may be provided in place of or in addition to one or more conventional central processing units (CPUs). For example, one or more graphics processing units 511 (GPUs), quantum processing units (QPUs), tensor processing units (TPUs), and / or other so-called accelerated processors (or processing accelerators) may be provided in addition to or in place of one or more CPUs.

[0060] System memory will typically include random access memory 530, but is more generally intended to encompass any type of non-transitory system memory, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), read-only memory (ROM), or combinations thereof. Solid-state drive 520 is shown as an example of a mass storage device, but more generally, such mass storage can include any type of non-transitory storage device configured to store data, programs, and other information and allowing access to such data, programs, and other information via system bus 560. For example, mass storage can include one or more of a solid-state drive, hard disk drive, disk drive, and / or optical disk drive.

[0061] Communication between the various components of the computing environment 500 can be achieved through a system bus 560, which includes one or more internal and / or external buses (e.g., PCI bus, Universal Serial Bus, IEEE 1394 FireWire bus, SCSI bus, Serial ATA bus, ARINC bus, etc.), to which each hardware component is electronically coupled.

[0062] Input / output interface 550 can enable networking functions such as wired or wireless network communication. As an example, input / output interface 550 may include network interfaces such as, but not limited to, network ports, network sockets, network interface controllers, etc. Several examples of how a network interface can be implemented will become apparent to those skilled in the art. For example, a network interface can implement specific physical layer and data link layer standards such as Ethernet, Fibre Channel, Wi-Fi, Token Ring, or serial communication protocols. Specific physical layer and data link layer standards can provide the foundation for a complete network protocol stack, allowing communication between small groups of computers on the same local area network (LAN), as well as large-scale network communication via routable protocols such as Internet Protocol (IP).

[0063] Input / output interface 550 may be coupled to touchscreen 590 and / or one or more internal and / or external buses 560. Touchscreen 590 may be part of a display. In some embodiments, touchscreen 590 is a display. Touchscreen 590 may also be referred to as screen 590. Figure 1 In the illustrated embodiment, the touchscreen 590 includes touch hardware 594 (e.g., a pressure-sensitive unit embedded in a layer of the display, allowing detection of physical interactions between the user and the display) and a touch input / output controller 592, allowing communication with the display interface 540 and / or one or more internal and / or external buses 560. In some embodiments, the input / output interface 550 may be connected to a keyboard (not shown), a mouse (not shown), or a touchpad (not shown), thereby allowing the user to interact with the computing environment 500 in addition to or in place of the touchscreen 590.

[0064] According to some implementations of this technology, the solid-state drive 520 stores program instructions suitable for loading into random access memory 530 and being executed by processor 510 to perform the actions of one or more methods described herein. For example, at least some of the program instructions may be part of a library or application.

[0065] The computing environment 500 may include any number of the components shown, which may be integrated into any number of physical devices. The computing environment 500 may be implemented as a cloud environment and / or a distributed architecture. The computing environment 500 may include multiple servers, which may be located in different physical locations and / or on different networks. The computing environment 500 may include a virtualization system. The methods described herein, or any part thereof, may be executed as a distributed application on multiple systems.

[0066] Nevertheless, it should be understood that although the embodiments presented herein have been described with reference to specific features and structures, various modifications and combinations can be made without departing from the basic concepts and principles taught in these disclosures. Therefore, the specification and drawings should be considered as providing helpful guidance on the basic concepts and principles presented in the implementations and methods.

[0067] Therefore, the scope of the basic concepts and principles presented in the disclosed implementations and methods is defined by the appended claims and is intended to cover any and all modifications, variations, combinations or equivalents falling within the scope of this disclosure.

Claims

1. A method (300) of detecting malicious threats by iterative aggregation of network flow information of received data packets, the method comprising: analyzing (304) network flow information of received data packets; allocating time interval windows for time aggregation (306) based on the network flow information of received data packets; determining respective data centers (DCs) for DC aggregation (308) based on network flow destination IP information of received data packets; determining respective IP subnet ranges for subnet aggregation (310) based on the network flow destination IP information of received data packets; evaluating a transport protocol for an IP subnet range and updating a packet size and / or a packet count based on received data packets (312); determining whether the updated packet size and / or packet count for the transport protocol of the IP subnet exceeds a first predefined threshold (314); evaluating a transport protocol for a respective server of the IP subnet and updating the packet size and / or packet count based on received data packets (320); and determining whether the updated packet size and / or packet count for the transport protocol of the server exceeds a second predefined threshold (322); wherein: upon determining that the updated packet size and / or packet count for the subnet transport protocol exceeds the first predefined threshold, issuing an alert indicating detection of a potential threat (316), and upon determining that the updated packet size and / or packet count for the server transport protocol exceeds the second predefined threshold, issuing an alert indicating detection of a potential threat. the network flow information of received data packets includes metadata comprising one or more of: a start time and an end time of received data packets, an IP destination address of received data packets, a transport protocol of received data packets, a total packet size of received data packets, and a packet count of received data packets.

2. The method (300) of claim 1, wherein the network flow information of received data packets is used to establish the first predefined threshold and the second predefined threshold.

3. The method (300) according to claim 1 or 2, wherein upon determining that the updated packet size and / or packet count for the subnet transport protocol does not exceed the first predefined threshold (314), continuing evaluation of the server transport protocol.

4. The method (300) according to any one of claims 1 to 3, wherein upon determining that the updated packet size and / or packet count for the server transport protocol does not exceed the second predefined threshold (322), iteratively returning (302) to evaluate subsequently newly received data packets.

5. The method (300) according to any one of claims 1 to 4, wherein, 6. The method (300, 400) of any one of claims 1 to 5, further comprising provisioning additional destination IP addresses of client requests by: providing additional destination IP addresses of client requests (402); performing a lookup function of a database (404) to identify stored previously registered IP addresses belonging to requesting clients; ​ associating (406) the additional destination IP address to a database based on the identified stored previously registered IP address; and registering and storing (408) in the database an additional IP address associated with the requesting client.

7. The method (300, 400) of claim 5, wherein After registering and storing (408) the additional IP address for the requesting client, returning (410) to the aggregation processing (310) of the method (300).

8. The method (300, 400) of claim 1, wherein Selecting the data packets to be received in part based on a statistical sampling process based on network flow traffic.

9. A system for detecting malicious threats by iteratively aggregating network flow information of received data packets, the system comprising: a network communication infrastructure (104) configured to facilitate transmission of received data packets and direct the received data packets to intended destinations based on destination IP addresses identified based on respective network flow information of the received data packets; at least one data center (DC) (106, 108) in communication with the network communication infrastructure (104), the at least one data center (DC) comprising at least one top-of-rack (ToR) network switching device (106A-B, 108A-B) configured to manage a plurality of servers (106A1-N, 106B1-B2, 108A1-AN, 108B1-B2) associated with an IP subnet; a temporal aggregation layer (202) configured to assign a time interval window to the received data packets based on a start time and an end time identified based on respective network flow information; a DC aggregation layer (204) configured to determine a corresponding DC (106, 108) serving an IP address range containing a destination IP address based on the destination IP address identified based on network flow information; a subnet aggregation layer (206) configured to: determine an IP subnet and a related subnet transport protocol based on the network flow information, evaluate the subnet transport protocol based on network flow information of the received data packets and update a packet size and / or a packet number, and determine whether the updated packet size and / or packet number of the subnet transport protocol exceeds a first predefined threshold value; a server aggregation layer (208) configured to: determine a server corresponding to the IP subnet and a related server transport protocol based on the network flow information, evaluate the server transport protocol based on network flow information of the received data packets and update a packet size and / or a packet number, and determine whether the updated packet size and / or packet number of the server transport protocol exceeds a second predefined threshold value; wherein: upon determining that the updated packet size and / or packet number of the subnet transport protocol exceeds the first predefined threshold value, issuing an alert indicating detection of a potential threat; and an alarm indicating detection of a potential threat is issued upon determining that the updated packet size and / or packet number of the server transport protocol exceeds a second predefined threshold.

10. The system of claim 9, wherein, The network flow information of the received data packets comprises metadata including one or more of: a start time and an end time of the received data packets, an IP destination address of the received data packets, a transport protocol of the received data packets, a total packet size of the received data packets, and a packet number of the received data packets.

11. The system of claim 9 or 10, wherein, The network flow information of the received data packets is used to establish a first predefined threshold and a second predefined threshold.

12. The system of any one of claims 9 to 11, further comprising a future aggregation layer (210) configured to: provide an additional destination IP address of a client request; perform a lookup function of a database to identify a previously stored registered IP address belonging to a requesting client; associate the additional destination IP address with the requesting client according to the identified stored previously registered IP address; and register and store the additional IP address associated with the requesting client in the database.

13. The system of claim 9, wherein, The selection of data packets to be received is made in part according to a statistical sampling process based on network flow traffic.

Images