Verizon Digital Media Services Inc.

Neurallq, Inc.

Countertack, Inc.

David Andrews

Derek Shiell

Robert J Peters

Alen Capalik

Amir Reza Khakpour

Hayes Kim

Reed Morrison

Ben Becker

Vikas Phonsa

Harkeerat Singh Bedi

Marcel Eric Schechner Flores

Sergio Leonardo Ruiz

Paulo Tioseco

William Rosecrans

Daniel Lockhart

Zachery Salwasser

Disclosed are different implementations for rapid configuration propagation across multiple servers of a distributed platform. One implementation is a push based distribution of update segments that are generated from a onetime differential analysis of an updated particular configuration relative to a previous instance of the particular configuration. Sequence numbers attached to the updated segments identify is a server's copy of a configuration is up-to-date and can receive a new updated segment or if missing intervening segments are to be retrieved from peers and applied prior to applying the new updated segment. Another implementation is a pull based distribution of compressed images of the configurations. A complete set of configurations are distributed as a compressed file system that is loaded into server memory. Individual configurations are read out of the file system and loaded into memory when implicated by client requests.

Rapid configuration propagation in a distributed multi-tenant platform

Optimized message flooding is provided for time sensitive or real-time contacting of nodes across a distributed platform. The propagation of messaging across the distributed platform is accelerated based on a parallel fan-out distribution of the flood messaging from increasing numbers of nodes with the distribution occurring over existing connections maintained between different sets of nodes. Responses are propagated via a reverse traversal of the nodes. The reverse traversal is optimized by merging responses at different tiers. A set of triggers set at the different nodes specify conditions with which to identify and preempt the slowest nodes of a lower tier from withholding message flooding completion. As such, desired messaging and responses can be collected from across the distributed platform in a determinate amount of time with minimal overhead.

Optimized message flooding across nodes of a distributed platform

Some embodiments provide techniques for mitigating against layerdistributed denial of service attacks. Some embodiments submit a computational intensive problem, also referred to as a bot detection problem, in response to a user request. Bots that lack sophistication needed to render websites or are configured to not respond to the server response will be unable to provide a solution to the problem and their requests will therefore be denied. If the requesting user is a bot and has the sophisticated to correctly solve the problem, the server will monitor the user request rate. For subsequent requests from that same user, the server can increase the difficulty of the problem when the request rate exceeds different thresholds. In so doing, the problem consumes greater resources of the user, slowing the rate at which the user can submit subsequent requests, and thereby preventing the user from overwhelming the server.

Unobtrusive and dynamic DDoS mitigation

A load balancing appliance distributes data packets across different virtual connections for ongoing communications with clients over a connectionless communication protocol including User Datagram Protocol (UDP) or Quick Internet UDP Connections (QUIC). The load balancing appliance a distributor that binds and listens on a port through which the connectionless traffic is received. The distributor distributes the traffic to a different set of managers at each interval based on each set of managers binding to and listening on a different set of ports. Each set of managers establishes and manages virtual connections establishing during a particular interval, wherein managing a virtual connection involves creating a secondary connection to a back-end server selected for engaging in ongoing communications with a client of the virtual connection, and performing any packet conversions between the virtual connection with the client and the secondary connection to the back-end server in order to bridge the connections.

Systems and methods for load balancing virtual connection traffic

Some embodiments provide distributed rate limiting to combat network based attacks launched against a distributed platform or customers thereof. The distributed rate limiting involves graduated monitoring to identify when an attack expands beyond a single server to other servers operating from within the same distributed platform distribution point, and when the attack further expands from one distributed platform distribution point to other distribution points. Once request rates across the distributed platform distribution points exceed a global threshold, a first set of attack protections are invoked across the distributed platform. Should request rates increase or continue to exceed the threshold, additional attack protections can be invoked. Distributed rate limiting allows any server within the distributed platform to assume command and control over the graduated monitoring as well as escalating the response to any identified attack.

Distributed rate limiting

A computer implemented method includes monitoring activity on the virtual machine. A plurality of activities being performed at the virtual machine is identified. Each of the activities includes an activity source, an activity target, and an association between the activity source and the activity target. The activity information is stored in the memory. The one or more of the activity sources, activity targets, and associations are transmitted to prevent future attacks.

System and method for identifying unauthorized activities on a computer system using a data structure model

Some embodiments provide techniques for mitigating against layer 7 distributed denial of service attacks. Some embodiments submit a computational intensive problem, also referred to as a bot detection problem, in response to a user request. Bots that lack sophistication needed to render websites or are configured to not respond to the server response will be unable to provide a solution to the problem and their requests will therefore be denied. If the requesting user is a bot and has the sophisticated to correctly solve the problem, the server will monitor the user request rate. For subsequent requests from that same user, the server can increase the difficulty of the problem when the request rate exceeds different thresholds. In so doing, the problem consumes greater resources of the user, slowing the rate at which the user can submit subsequent requests, and thereby preventing the user from overwhelming the server.

Some embodiments provide reconfigurable web application firewall (WAF) functionality across a distributed platform. Specifically, the WAF function at each distributed platform server is customizable on a per customer and per inbound message basis. When a server receives an inbound message, the server identities the content or services of which specific customer are implicated by the inbound message. The server screens the inbound message for attacks using a first set of rules and policies defined as part of a production profile from a WAF instance defined by the specific customer while contemporaneously testing the inbound message against a second set of rules and polices defined as part of an audit profile from the same WAF instance. In this manner, the specific customer tests the audit profile rules and policies while still receiving the protections of the production profile rules and policies.

Real-time reconfigurable web application firewall for a distributed platform

A computer implemented method includes monitoring activity on the virtual machine. A plurality of activities being performed at the virtual machine is identified. Each of the activities includes an activity source, an activity target, and an association between the activity source and the activity target. The activity sources, activity targets, and associations are stored in the memory. A fingerprint indicative of the activity on the virtual machine is created from the stored activities. The fingerprint is transmitted to prevent future attacks that comprise the same or similar activities as indicated by the fingerprint.

A method includes receiving a list of target addresses, locating a first page table entry corresponding to the first page, and determining the first executability state. When the first executability state is non-executable, a first set of one or more target addresses that correspond to the first page, and a second set of one or more target addresses that correspond to one or more pages other than the first page are identified. One or more target addresses are stored in breakpoint registers of the computer system. The first executability state of the first page table entry is set as executable, and the executability states of page table entries that correspond to the second set of target addresses are set as non-executable. When the first address matches one of the target addresses stored in the breakpoint registers, forensic data is recorded.

Growing community of inventors

Los Angeles, CA, United States of America

David Andrews