International Business Machines Corporation

Chih-Hung Chou

Kuo-Chun Chen

Wei-Hsiang Hsiung

Sheng-Tung Hsu

Cheng-Ta Lee

Chun-Shuo Lin

Yin Lee

Sheng Hao Wang

Jiande Jiang

Preventing Transport Layer Security session man-in-the-middle attacks is provided. A first security digest generated by an endpoint device is compared with a second security digest received from a peer device. It is determined whether a match exists between the first security digest and the second security digest based on the comparison. In response to determining that a match does not exist between the first security digest and the second security digest, a man-in-the-middle attack is detected and a network connection for a Transport Layer Security session is terminated with the peer device.

Transport layer security session man-in-the-middle attack prevention

Embodiments can provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for network protection, the method comprising determining, by the processor, if an incoming connection comprising one or more packets has a false latency larger than a trigger latency; determining, by the processor, if an attack is currently in progress; and if the attack is in progress, injecting, by the processor, at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency.

Identification of attack flows in a multi-tier network topology

An example operation may include one or more of obtaining a request to validate an application with respect to an OAuth provider, identifying a previously registered digital signature of the application, generating verification information of the application based on the identified digital signature of the application, and passing the generated verification information of the application to the OAuth provider via a user login page.

Phishing attack prevention for OAuth applications

Embodiments can provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for network protection, the method comprising determining, by the analyzing unit, if an incoming connection comprising one or more packets has a false latency larger than a trigger latency; if the incoming connection latency is larger than the trigger latency, reporting, by the analyzing unit, the incoming connection as a suspicious connection; determining, by the analyzing unit, if an attack is currently in progress; and if the attack is in progress, injecting, by the analyzing unit, at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency.

A system, method and computer program product for detecting distributed denial-of-service (DDoS) attacks is provided. Current aggregated flow information for a defined period of time is analyzed. It is determined whether network flow increased above a defined flow threshold value to a second data processing system connected to a network within the defined period of time based on analyzing the current aggregated flow information. In response to determining that the network flow has increased above the defined flow threshold value to the second data processing system connected to the network within the defined period of time, it is determined that the second data processing system is under a DDoS attack.

Distributed denial-of-service attack detection based on shared network flow information

A system and computer program product for preventing abnormal application activity is provided. Packets are retrieved from a packet buffer using packet location information corresponding to information associated with the abnormal application activity in a data processing system. The packets are analyzed to identify content of the network packets causing the abnormal application activity. Network packets containing the content causing the abnormal application activity in the data processing system are blocked.

Retrieving network packets corresponding to detected abnormal application activity

A method for preventing abnormal application activity is provided. Packets are retrieved from a packet buffer using packet location information corresponding to information associated with the abnormal application activity in a data processing system. The packets are analyzed to identify content of the network packets causing the abnormal application activity. Network packets containing the content causing the abnormal application activity in the data processing system are blocked.

A system and computer program product for detecting distributed denial-of-service (DDoS) attacks is provided. Current aggregated flow information for a defined period of time is analyzed. It is determined whether network flow increased above a defined flow threshold value to a second data processing system connected to a network within the defined period of time based on analyzing the current aggregated flow information. In response to determining that the network flow has increased above the defined flow threshold value to the second data processing system connected to the network within the defined period of time, it is determined that the second data processing system is under a DDoS attack.

A method for detecting distributed denial-of-service (DDoS) attacks is provided. Current aggregated flow information for a defined period of time is analyzed. It is determined whether network flow increased above a defined flow threshold value to a second data processing system connected to a network within the defined period of time based on analyzing the current aggregated flow information. In response to determining that the network flow has increased above the defined flow threshold value to the second data processing system connected to the network within the defined period of time, it is determined that the second data processing system is under a DDoS attack.

Growing community of inventors

Taipei, Taiwan

Chih-Hung Chou