Imperva, Inc.

Jonathan R Azaria

Ori Nakar

Nadav Avital

Ben Herzberg

Aiah Lerner

Ori Or-Meir

Avishay Zawoznik

Amir Shladovsky

Matan Lion

A method by one or more network devices implementing a scrubbing center for mitigating distributed denial of service attacks, where the scrubbing center is communicatively coupled to a plurality of clients and one or more servers. The method includes determining a set of packet fingerprints seen in a set of packets sent between the plurality of clients and the one or more servers, assigning a risk value to each packet fingerprint in the set of packet fingerprints based on analyzing previous security decisions made for packets having that packet fingerprint, and responsive to detecting an occurrence of a potential distributed denial of service attack, activating a security measure for each of one or more packet fingerprints in the set of packet fingerprints based on the risk value assigned to that packet fingerprint.

Packet fingerprinting for enhanced distributed denial of service protection

Embodiments of the present disclosure relate to detecting new attack vectors in web application servers based on analyzing requests (e.g., HTTP/S requests) that were flagged as attacks by a machine learning web application firewall (ML WAF) but not by a rule-based WAF. Such requests may be grouped together using a clustering algorithm, and the features that are determined as being high contributors to an overall attack probability in a threshold number of such requests may be used to determine new attack vectors.

Layer 7 network attack detection using machine learning feature contribution

A method by a network device for dynamically detecting emotional states of a user operating a client end station to interact with an application. The method includes receiving information regarding user inputs received by the client end station from the user while the user interacted with the application during a particular time period and determining an emotional state of the user based on analyzing the information and information regarding user inputs received by the client end station from the user while the user interacted with the application during one or more previous time periods that together with the particular time period form a time window.

Dynamic emotion detection based on user inputs

A method is described for a proxy to mitigate attacks from web application clients based on context of web application layer requests. The method includes receiving a plurality of web application layer requests from a web application layer client; aggregating a first set of requests from the plurality of web application layer requests, wherein the first set of requests are part of a first session; determining a profile based on the first set of requests, wherein the profile describes a baseline of expected behavior for a user of the web application layer client; and determining a first threat value associated with the first set of requests based on the first set of requests and the profile, wherein the first threat value describes the likelihood that the first set of requests are part of an attack on one or more web application servers.

Growing community of inventors

Beit Gamliel, Israel

Jonathan R Azaria