Centurylink Intellectual Property LLC

Level 3 Communications, LLC

Dean Ballew

John R B Woodworth

Stewart Bamford

John R Woodworth

Mark Dehus

Laurence R Lipstone

William R Power

Dan Luther

James C Anders

Paul Carpenter

Shashwath Bindinganaveli Raghavan

John Rb Woodworth

Brian J Strong

Lisa Lamanna

Carol Dawn Lovell

Configuration changes to the configurations of end devices in a network may be made by configuration devices, which may set up connections with the end devices and send configuration commands to the end devices. In such a system, the compromising of a configuration device may make it possible for an attacker to reconfigure end devices. Systems and methods to improve network security via a consensus-driven configuration plane are provided.

Systems and methods to improve network security via consensus-driven configuration plane

The present application describes systems and methods for populating a DNS cache of a recursive DNS server using information gathered by a threat intelligence system. The threat intelligence system may collect some or all DNS responses from one or more recursive DNS servers as the one or more DNS servers process various received requests. Since the threat intelligence engine has access to this DNS data, the DNS data may be used to seed a DNS cache of a recursive DNS server.

Using a threat intelligence framework to populate a recursive DNS server cache

Systems and methods for mitigating DNS amplification attacks are provided. In one example, a threat intelligence system collects data about the requests received by a DNS server, and/or responses generated by the DNS server. The threat intelligence system triggers a threat mitigation action upon detecting evidence (in one or more forms) of a DNS amplification attack. The threat mitigation action may include filtering DNS responses generated by the DNS server. The filtering rule may indicate that a DNS response in which the payload size is above a threshold payload size is to be dropped. In examples, the payload threshold size is dynamically set by the threat intelligence system using a machine learning model to minimize the filtering of DNS responses for valid DNS queries, while maximizing filtering of DNS responses for malicious DNS queries.

Systems and methods for mitigating domain name system amplification attacks

Novel tools and techniques are provided for implementing improvement to domain name system ('DNS') security. In various embodiments, a computing system may receive a user datagram protocol (“UDP”)-based DNS request, and may send a UDP-based response message, which may include an empty payload portion and a header portion containing a truncate flag that is set, which indicates to resend the request as a transmission control protocol (“TCP”)-based DNS request. When the TCP-based DNS request is received within a first period, the computing system may send, to the source address, a TCP-based response message comprising an answer to a query (in the TCP-based DNS request) for a destination DNS record associated with a destination device. If no TCP-based DNS request is received from the source address within the first period, the computing system may block all UDP-based DNS requests from the source address for at least a second period.

Domain name system (DNS) security

In a network system, network switching devices such as routers may store routes to various networks. The system may on occasion be reconfigured, e.g., as new network switching devices are brought on line, or as servers are moved to new locations. Such reconfiguring may involve the storing of new routes in a network switching device, or the deletion of routes stored in a network switching device. As such, systems and methods for cloaking routes are provided.

Systems and methods for cloaking routes

Dynamic and self-healing optimized traffic rerouting is provided. A system and method are described for determining and implementing optimized traffic routing decision. A route orchestration system monitors network resource performance characteristics information for identifying a traffic redirection triggering event and for determining an optimized traffic control decision based on the network resource performance characteristics information. The decision may include software defined networking (SDN) instructions that may be communicated to one or more network resources (e.g., PE devices, P devices, and/or routers) that may cause traffic to be rerouted the one or more targeted servers. For example, the optimized traffic control decision may be determined to improve load balancing amongst performing servers and other network resources in the network while reducing or minimizing administrative costs. Network resources may include a programmatic component that allows the optimized traffic control decision determined by the route orchestration system to be implemented by the resource.

Traffic monitoring and orchestration

The present application describes a system and method for utilizing a tunnel in a networking routing protocol to provide a network segment access to additional servers when certain load balancing trigger events are detected.

Router fluidity using tunneling

In examples, a first Anycast advertisement is received from a first server identifying the first server as a primary address for a service. In addition, a second Anycast advertisement is received from the first server identifying the first server as a secondary address for the service. Further, a third Anycast advertisement is received from a second server identifying the second server as the secondary address for the service. A first community advertisement is also from the first server identifying the first server as a member of a first community. Thereafter, a first request is received from a client including the primary address, and the request is routed to the first server. When a second request from the client is received including the secondary address, based at least on the community advertisement, the first server is ignored, and the second request is routed to the second server.

Filtered advertisements of secondary servers

In a distributed replicated storage system, an active server may, during normal operation, service requests from clients, and back up its persistent storage to a backup server. The backup server may be configured to become an active server autonomously if the active server fails. If a network connection between the active server and the backup server fails, severing the connection between the active server and the backup server, the backup server may become a second active server and begin to service requests from clients, and the original active server may continue to service requests from clients. This may result in inconsistencies in the persistent storage of the original active server and of the second active server. As such, a system and method for intelligent merging of primary and backup data in a distributed replicated storage system are provided.

Intelligent merge of primary and backup data

Customer premises equipment, such as a gateway device, for making a connection to an Internet service provider (ISP) may on occasion be defective or improperly set up, and in such circumstances remote troubleshooting by a technician employed by the Internet service provider may be hampered by the absence of a connection to the customer premises equipment. As such, a system and method for providing a secondary link to customer premises equipment are provided.

Out-of-band communications for customer premises equipment

The present disclosure describes a system and method for providing dynamic remediation of a pluggable streaming device issue, such as a customer premises equipment (CPE) device. Sometimes, various features of the CPE device to begin to fail. For example, synchronization of the audio and video streams may drift, media rental purchases may time out, or playback may throttle to low quality. Such failures can be caused by device or network issues. The present disclosure describes a CPE remediation system that operates to identify a failure associated with playing media streamed by the CPE device. The CPE remediation system may further determine a solution to remediate an observed CPE device-related failure. In some examples, the CPE remediation process may further provide or perform one or more actions included in the determined solution. In some examples, the solution may include a warm or a cold reboot.

Dynamic remediation of pluggable streaming devices

In a system with a plurality of servers serving one or more clients, situations may arise in which a client has a connection to a first server which is providing a service to the client, and in which it would be advantageous to transfer the connection to a second server, in a manner that does not require the re-establishing of the connection or the making of a renewed request, by the client, for the service. As such, a system and method for transferring a client connection from one server to another server are provided.

System and method for transferring a client connection

A method for controlling deployment of network configuration changes includes receiving, by centralized network management system executed by a processor and memory, configuration change instructions to alter a configuration of a network; computing, by the centralized network management system, a weighted impact of the configuration change instructions; determining, by the centralized network management system, whether the weighted impact of the configuration change instructions exceeds a threshold impact level; and in response to determining that the weighted impact does not exceed the threshold impact level, executing the configuration change instructions.

Systems and methods for controlling the deployment of network configuration changes based on weighted impact

Example systems and methods permit threat intelligence to be determined and used at a local, regional, and/or global level in a communications network. A threat intelligence system may collect traffic information from local computing systems and analyze it for malicious traffic. If a measure of malicious traffic in a local computing system is reached, mitigation actions may be taken in that local computing system. In addition, threat measures may be amplified in other local computing systems, other regions, or globally in the network, in order to more quickly react to a known threat as it may spread in a network.

Varifocal threat analysis system and method

Multiple Anycast regions may be defined, and a separate Anycast address may be used for each region in order to localize client requests. In examples, when one or more Anycast servers in a first Anycast region fail or become overburdened (or are predicted to do so), one or more Anycast server in another, geographically or logically separate Anycast region that has additional capacity to handle client service requests may be dynamically added to the first Anycast region.

Growing community of inventors

Sterling, VA, United States of America

Dean Ballew