METHOD AND SYSTEM FOR DEFENDING AN INFRASTRUCTURE AGAINST A DISTRIBUTED DENIAL OF SERVICE ATTACK
FIG2 is a block diagram of an infrastructure implementing a method and a system for defending against a DDoS attack in accordance with an embodiment of the present technology
Referring now to the drawings, FIG2 is a block diagram of an infrastructure implementing a method and a system for defending against a DDoS attack in accordance with an embodiment of the present technology. An infrastructure 100 may for example represent a data center, or a plurality of data centers, providing hosting services for one or more customers. In the example of FIG2, a game server 110 owned by a customer of the infrastructure operator is hosted in the infrastructure 100. It will be appreciated that the infrastructure 100 may include a large number of servers for hosting services for a large number of customers and that the infrastructure 100 may be distributed over a plurality of datacenters (not shown) for redundancy, reliability and/or load sharing purposes. The datacenters forming the infrastructure 100 may be geographically distributed, for example worldwide. The illustrated infrastructure 100 of FIG2 is heavily simplified for ease of illustration.
block diagram
12
server
22
ports
18
devices bots
100
infrastructure
130
C&C data collector
2
two
140
client
110
game server
150
cleaning component
120
software decoy software decoys
['1. A method for defending an infrastructure (100) against a distributed denial of service, DDoS, attack, comprising: receiving (420), at a software decoy (120) of the infrastructure (100), a malware intended to infect the software decoy (120); receiving the malware from the software decoy (120) at a command and control, C&C, data collector (130) of the infrastructure (100); and extracting (425) from the malware, by the C&C data collector (120), an address or a domain name of a C&C server (12); characterized in that  the method further comprises: sending, from the C&C data collector (130) to a client (140) of the infrastructure (100), the address or the domain name of the C&C server (12); using (430), by the client (140), the address or the domain name of the C&C server (12) to connect the client (140) to the C&C server (12); receiving (435), at the client (140), a command intended by the C&C server (12) to cause the client (140) to participate in the DDoS attack; forwarding (440) particulars of the DDoS attack from the client (140) to a cleaning component (150) of the infrastructure (100); and discarding (450), in the cleaning component (150), incoming signals having at least one of the particulars of the DDoS attack.']