Cisco Technology, Inc.

Riverhead Networks Inc.

International Business Machines Corporation

Ramot Ltd.

Netformx

Dan Touitou

Guy Pazi

Yehuda Afek

Rephael Tzadikario

Rami Rivlin

Daniel George Wing

Cullen F Jennings

Anat Bremler-Barr

Alon Golan

Yehiel Shtein

Keren Horowitz

Rajan Goyal

Scott S Firestone

Darrel Jay Lewis

Ohad Rodeh

Michael Zayats

Tamir Gal

Edya Ladan-Mozes

Jacob P Ukelson

Asaph Zemach

Nir Shavit

Anat Bremler-Bar

Roi Hermoni

Hank Nussbacher

Lior Schneider

Anat Bremler Barr

Keren Horvitz

Rafi Zadikario

Rephael Tzakikario

Yehiel Stein

Dror Karmi

Karen Horowitz

Rafi Tzadikario

Anat Bremler Bar

There may be provided a method for model-based risk assessment of a computerized network, the method may include obtaining a model of the computerized network, the model comprises risk assessments building blocks that represent (a) risk related dependencies between members of sets of assets of the computerized network, and (b) probabilities of occurrence of the risk related dependencies; and simulating, for at least some of the assets of the computerized network, and based on at least a portion of the model, one or more attacks to provide one or more model-based risk assessment results.

Risk assessment management

A method for processing communication traffic includes monitoring the communication traffic that is directed to a group of addresses on a network, and determining respective baseline characteristics of the communication traffic that is directed to each of the addresses in the group. Deviations from the respective baseline characteristics of the communication traffic directed to at least one of the addresses in the group are detected, as an indication that at least some of the communication traffic may be of malicious origin. Responsively to detecting the deviation, the communication traffic that is directed to all of the addresses in the group is filtered so as to remove at least some of the communication traffic that is of the malicious origin.

Detecting and protecting against worm traffic on a network

A method for authenticating communication traffic includes receiving an initial incoming message, sent over a network from a source address to a destination address. In reply to the initial incoming message, an outgoing message containing an encoded token is sent to the client. Upon receiving a number of further incoming messages from the source address containing the encoded token, delivery of one or more of the further incoming messages to the destination address is inhibited when the number exceeds a predetermined threshold.

Handling of DDoS attacks from NAT or proxy devices

A method includes monitoring outgoing request packets transmitted by a node in a protected network over a link connecting the protected network to an external network. Incoming response packets that originate in the external network and are destined for transmission to the node are also monitored. One or more of the incoming response packets that were not solicited by any of the outgoing request packets are identified responsively to monitoring the outgoing request packets and the incoming response packets. A characteristic that differentiates between the identified incoming response packets and the incoming response packets that were solicited by the outgoing request packets is determined. A guard device in the external network is instructed to inhibit the transmission over the link of subsequent unsolicited response packets based on the characteristic.

Protection against reflection distributed denial of service attacks

A method for authenticating communication traffic includes intercepting a request directed over a network from a source address to open a connection to a target computer in accordance with a handshake procedure specified by a predetermined communication protocol. A reply to the request that deviates from the specified handshake procedure is sent to the source address. A response from the source address to the reply is analyzed in order to make an assessment of legitimacy of the source address. Upon determining, based on the assessment, that the source address is legitimate, the target computer is permitted to complete the handshake procedure so as to open the connection with the source address.

Using TCP to authenticate IP source addresses

Authenticating an endpoint using a STUN server includes facilitating a communication session between a first endpoint and a second endpoint over a network. A challenge request is sent to the second endpoint. The challenge request attempts to authenticate the second endpoint and includes an identification. The identification is associated with an expected response identification. A response to the challenge request is received from the second endpoint. The response has an actual response identification. The received response is verified to establish whether the second endpoint is legitimate. The second endpoint is legitimate if the actual response identification includes the expected response identification.

Authenticating an endpoint using a STUN server

Methods and apparatus for protecting against and/or responding to an overload condition at a node ('victim') in a distributed network divert traffic otherwise destined for the victim to one or more other nodes, which can filter the diverted traffic, passing a portion of it to the victim, and/or effect processing of one or more of the diverted packets on behalf of the victim. Diversion can be performed by one or more nodes (collectively, a 'first set' of nodes) external to the victim. Filtering and/or effecting traffic processing can be performed by one or more nodes (collectively, a &#x201c;second set&#x201d; of nodes) also external to the victim. Those first and second sets can have zero, one or more nodes in common&#x2014;or, put another way, they may wholly, partially or not overlap. The methods and apparatus have application in protecting nodes in a distributed network, such as the Internet, against distributed denial of service (DDoS) attacks.

Methods and apparatus for protecting against overload conditions on nodes of a distributed network

A method for processing communication traffic includes receiving a data packet sent over a network from a source address and reading a value of an attribute from the data packet. The value is hashed to determine a key, which is used as an index in extracting a tag from a table of random values. A decision is made using the tag regarding forwarding of the communication traffic from the source address.

Efficient cookie generator

A computer-implemented method is provided for screening communication traffic. A list of one or more threshold pairs including respective first and second threshold values, each of which first threshold values is greater than one, are defined. Network traffic from a plurality of sources is monitored, so as to determine for each source a count of unique destination addresses to which the source transmitted data during a period of time. A response to malicious network traffic is invoked responsively to finding that each of a first number of the sources sent data to at least a second number of the destination addresses, wherein, for at least one of the threshold pairs, the first number is at least equal to the respective first threshold value, and the second number is at least equal to the respective second threshold value.

Using threshold lists for worm detection

A method for authenticating communication traffic includes receiving a first Domain Name System (DNS) request, sent using a connectionless protocol over a network from a source address, to provide network information regarding a domain name. Responsively to the first DNS request, a client at the source address is solicited to send a second DNS request using the connectionless protocol. An authenticity of the first DNS request is assessed based on the second DNS request.

DNS anti-spoofing using UDP

A defender operable to support options in a communication session intercepts a connection request packet sent from a client to a server. The defender identifies a client option combination associated with the client from the connection request packet. The defender establishes a client option index corresponding to the client option combination, and encodes the client option index into a cookie of an acknowledgment packet. The defender then sends the acknowledgment packet to the client.

Supporting options in a communication session using a TCP cookie

A method for authenticating communication traffic includes receiving a Session Initiation Protocol (SIP) data packet sent over a network from a source address to a destination address, sending an outgoing SIP message to the source address, receiving an incoming SIP message in response to the outgoing SIP message and processing the incoming SIP response message so as to assess authenticity of the received SIP data packet.

Authentication of SIP and RTP traffic

A method for authenticating communication traffic includes receiving a first message, sent over a network from a source address, requesting information from a server in accordance with a higher-level protocol. A challenge is sent to the source address in reply to the first message, in accordance with the higher-level protocol. A second message is received from the source address following the challenge, and the legitimacy of the source address is assessed by determining whether the second message contains a correct response to the challenge.

Upper-level protocol authentication

An improved network device that controls throughput of packets received thereby, e.g., to downstream devices or to downstream logic contained within the same network device. The network device comprises a scheduler that schedules one or more packets of a selected class for throughput as a function of a weight of that class and weights of one or more other classes. The weight of at least the selected class is dynamic and is a function of a history of volume of packets received by the network device in the selected class. An apparatus for protecting against overload conditions on a network, e.g., of the type caused by DDoS attacks, has a scheduler and a token bucket mechanism, e.g., as described above. Such apparatus can also include a plurality of queues into which packets of the respective classes are placed on receipt by the apparatus. Those packets are dequeued by the scheduler, e.g., in the manner described above, for transmittal to downstream devices (e.g., potential victim nodes) on the network.

Weighted fair queuing-based methods and apparatus for protecting against overload conditions on nodes of a distributed network

A method for authenticating communication traffic includes receiving a first request, such as a DNS request, sent over a network from a source address, to provide network information regarding a given domain name. A response is sent to the source address in reply to the first request. When a second request is from the source address in reply to the response, the authenticity of the first request is assessed based on the second request.

Growing community of inventors

Ramat Gan, Israel

Dan Touitou