Amazon Technologies, Inc.

Karl Andre McCabe

Jon Arron McClintock

David Erdmann

Robert Kennedy

Adam Cecchetti

Thibault Candebat

Eric J Martin

Paul A Stancik

Matthew Dean Rehder

Eoin Francis Cavanagh

Brian Long

Dzianis Lisouski

Michal Zygmunt Zawirski

Alan Michael Judge

Tyson James Lamoreaux

Timothy Richard Kohn

Carlos Vara Callau

Sonali Roy

David James Roy Erdmann

Brian R White

Brian Joseph Callan

John Corrigan

A traffic shifting system is described to shift traffic away from one or more network devices or interfaces. The system ensures that traffic can be safely shifted off of a network device before the shifting occurs. The method is described as broken into several phases, such as a discovery phase, a pre-check phase, a shifting phase, and a post-shift phase. Before shifting occurs, the discovery phase is used to obtain network topology and configuration information. In the pre-check phase, that information is interrogated so that a shifting can be performed without negatively impacting the network. If the pre-check phase is passed, then the network shifting can occur through adjustment of configuration parameters, such as a cost parameter associated with an interface on any devices for which traffic is being shifted. Finally, in the post-shift phase, checks are performed to ensure traffic is shifting away from the network device.

Shifting network traffic from a network device

Generally described, systems and methods are provided for detecting the impact of network failures. The system collects performance information from a plurality of nodes and links in a network, aggregates the collected performance information across paths in the network, processes the aggregated performance information for detecting failures on the paths, adjusts the set of performance information by removing the performance information for any nodes considered to be associated with performance information that is statistically different from performance information from other nodes at a given location or extrapolates the collected information to other paths, and determines the impact to customers of the network failures detected using the adjusted set of performance information.

Determining impact of network failures

Technologies are provided for active monitoring of network fabrics, such as border network fabrics. For example, test packets can be generated and sent to destination devices within the network fabrics. The test packets can have destination ports that have been identified as closed destination ports. The success of the test packets can be determined based on whether ICMP error packet responses are received. If a network problem is detected based on results of the test packets, then traceroute packets can be used to identify the location of the network problem.

Active monitoring of border network fabrics

Disclosed are various systems, methods, and other embodiments directed to detection of malware in content items. To detect the malware, for example, one or more content items are identified in association with the rendering of a network page in a simulated environment. A plurality of tests are applied to the one or more content items to detect an existence of malware associated with the content items.

Detecting malware in content items

A traffic shifting system is described to shift traffic away from one or more network devices or interfaces on those devices. The system ensures that traffic can be safely shifted off of a network device before the shifting occurs. The method is described as broken into several phases for simplicity, such as a discovery phase, a pre-check phase, a shifting phase, and a post-shift phase. Before shifting occurs, the discovery phase is used to obtain network topology and configuration information. In the pre-check phase, that information is interrogated so that a shifting can be performed without negatively impacting the network. If the pre-check phase is passed, then the network shifting can occur through adjustment of configuration parameters, such as a cost parameter. Finally, in the post-shift phase, checks are performed to ensure traffic is shifting away from the network device.

Shifting network traffic

Techniques described and suggested herein include systems and methods for identifying potential sources of infections of devices by unauthorized code. In an embodiment, network traffic is logged. A plurality of computing devices that include unauthorized code is identified. The logged traffic is used to identify information sources accessed by the identified affected devices. The identified information sources may be refined. Refinement of the identified information sources may include excluding information sources that have been accessed by uninfected devices. A user interface that allows a user to further refine the identified information sources may be provided.

Techniques for identifying sources of unauthorized code

A policy-driven automatic network remediation service is described, which resides on the network and is triggered when a network fault is detected. Once triggered, the service automatically connects to network devices in the topological locale of the detected fault and collects diagnostic information from the affected area, running diagnostics which are appropriate to the fault type. The service can validate a set of preconditions prior to taking remedial action. For example, the service can empirically validate that the network topology is actually as expected and that automatic remediation would be safe and would not compromise network availability or redundancy. Diagnostic information can be recorded in a trouble ticket to support post-event auditing. Once the preconditions have been validated, the service can automatically take corrective action based on the type of the fault, such as shutting down an interface on a particular network device.

Policy-driven automatic network fault remediation

Disclosed are various embodiments for determining a source of malware. At least one embodiment of a method includes receiving browsing data from a plurality of client devices, the data being sent by the plurality of client devices, in response to a determination of malware on the plurality of client devices and determining, from the browsing data, a source for the malware. Further, some embodiments include determining whether the source for the malware is associated with a predetermined network site and in response to determining that the source of the malware is associated with a predetermined network site, preventing download of at least a portion of the predetermined network site.

Detecting malware

Disclosed are various systems, methods, and other embodiments directed to detection of malware in content items. To detect the malware, for example, an environment is simulated in a computing device configured to render a network page having a container for content placement. The existence of malware in a content item is detected in the computing device by implementing a rendering of the network page in the environment with the content item inserted in the container to detect an unauthorized action by the content item.

Growing community of inventors

Dublin, Ireland

Karl Andre McCabe