Arbor Networks, Inc.

Cisco Technology, Inc.

Netscout Systems, Inc.

Netscout Systems Texas, LLC

Steinthor Bjarnason

Michael H Behringer

Brian St Pierre

Yves Hertoghs

Yves Francis Eugene Hertoghs

Max Pritikin

Sean O'Hara

Ellis Roland Dobbins

Andrew Ralph Beard

David Turnbull

Balaji B L

Alvaro E Retana

Toerless Eckert

Bruno Klauser

Timothy David Dodd

BL Balaji

Michael Behringer

Balaji BL

A system is disclosed. The system can include a network monitoring device connected to a communications network. The network monitoring device to store a probabilistic data structure indicating one or more domain names; receive a response data packet from the DNS server, the response data packet comprising a first domain name transmitted in a query to the DNS server and an affirmative response code; update the probabilistic data structure with the first domain name identified from the response data packet; responsive to detecting an attack on the network, retrieve a query message, the query message containing a second domain name; query the updated probabilistic data structure with the second domain name; and restrict transmission of the query message or communication by the computing device with the DNS server.

Systems and methods for protecting DNS servers from water torture DDOS attacks

Systems and methods for network traffic monitoring are provided. A system may monitor a first plurality of encrypted data packet exchanges between a server and a plurality of network devices, determine one or more metric baselines corresponding to a plurality of metric types for communication between the server and the plurality of network devices, monitor a second plurality of encrypted data packet exchanges between the server and a second plurality of network devices, identify a set of encrypted data packet exchanges from the second plurality of encrypted data packet exchanges each having a duration exceeding a first threshold, determine an exchange metric for each of the plurality of metric types, identify one or more encrypted data packet exchanges having at least one exchange metric exceeding a metric baseline, and apply a tag to one or more network devices of the second plurality of network devices.

Systems and methods for selective decryption of encrypted data packets

A computer implemented method system for obscuring the status of a network service provided by a network device. Received in a network monitoring device is network packet request message intended for a network device. The network monitoring device analyzes the received network packets request to determine whether the received network packet request is a DDoS network probe packet request. If the received packet request was determined to be a DDoS network probe packet requests, a response is generated and sent from the network monitoring device to the device that sent the DDoS network probe packet request indicating a faux degradation of service level for the intended network device.

System and method for obscuring status of a network service

A method of detecting patterns in network traffic is provided. The method includes receiving packets of network traffic, performing a frequency analysis per field of the packets as a function of frequency of the occurrence of the same data in the corresponding field, and selecting top values which are values associated with each field of the set of fields that satisfy a criterion as having occurred most frequently in the packets as a function of a result of the frequency analysis. The method further includes assigning a bit encoding scheme that uses variable bit encoding to encode each of the top values for each field that has a top value, encoding into a single value each packet of the packets based on a bitfield representation that uses the encoding scheme for values associated with each field that has a top value, storing each potential combination of fields of the set of fields being processed, with all bits set per field when the field is an active field and no bits set when the field is inactive, performing a bitwise operation on each encoded packet with the stored potential combinations, sorting the results of the bitwise operation based on a number of the active fields and a number of occurrences of each same result of the bitwise operation, and providing the results of the sorting to a mitigation device for determining whether an attack is underway and/or for filtering network traffic for mitigating an attack.

Automatic detection of malicious packets in DDOS attacks using an encoding scheme

A computer system and process for mitigating a Distributed Denial of Service (DDoS) attack by analyzing and correlating inbound and outbound packet information relative to the one or more protected computer networks for detecting novel DDoS Reflection/Amplification attack vectors. Created are separate data repositories that respectively store information relating to captured inbound and outbound packets flowing to and from the protected computer networks. Stored in each respective inbound and outbound data repository are identified inbound destination ports respectively associated with the captured inbound and outbound packets such that each identified inbound destination port number is associated with 1) a packet count relating to the inbound and outbound packets; and 2) a packet byte length count relating to each of the inbound and outbound packets. By accessing the inbound and outbound data repositories, a determination is made as to whether a total inbound packet count for a first inbound destination port is substantially the same to a total outbound packet count for a same inbound destination port. A next determination is then made as to whether a total outbound packet byte length count for the first inbound destination port exceeds a total inbound packet byte length count for the same inbound destination port. DDoS attack mitigation is automatically performed for the protected computer networks responsive to preferably determining 1) the total inbound packet count for a first inbound destination port is substantially the same to a total outbound packet count for a same inbound destination port; and 2) the total outbound packet byte length count exceeds a ratio value relative to the total inbound packet byte length count for the same inbound destination port.

Detecting DDOS attacks by correlating inbound and outbound network traffic information

A method of configuring a filter to perform pattern matching against input data is provided. The method includes receiving one or more rules, each rule including one or more field specifiers, each field specifier including a value specifier that specifies a value to be matched and a location specifier that specifies a location in the input data. For each rule of the one or more rules an empty buffer is initialized. For each field specifier the value specified by the field specifier is appended to the buffer, and the buffer contents are inserted into contents of a probabilistic data structure representing all of the field specifiers of the rule. The probabilistic data structure is configured to receive a query that includes query buffer contents determined from the input data and respond with a match status of probably present based on a predetermined probability, or definitely not present.

Filtering packets of network traffic using probabilistic pattern matching

A computer system and process for mitigating a Distributed Denial of Service (DDoS) attack to one or more protected computer networks by determining keywords and/or patterns in HyperText Transfer Protocol (HTTP) responses. Stored HTTP responses are analyzed to extract one or more HTTP characteristics for each stored HTTP response. One or more patterns having one or more keywords in each stored HTTP response is determined utilizing the extracted one or more HTTP characteristics for each stored HTTP response. A hash value is determined for each determined pattern, which is preferably stored in a hash structure accompanied by its respective determined HTTP characteristics. Each hash value accompanied by its respective determined HTTP characteristics is stored as a mitigation filter candidate if the hash value contains a determined pattern consisting of at least a predetermined percentage of all determined patterns stored in the hash structure. A determination is then made as to whether if each stored filter candidate contains an acceptable pattern, whereby filter candidates having acceptable patterns are removed from being a mitigation filter candidate. A regular expression is then generated for each stored filter candidate adaptable to be utilized as keywords in a DDOS mitigation filter.

Detecting patterns in network traffic responses for mitigating DDOS attacks

A method for detecting patterns using statistical analysis is provided. The method includes receiving a subset of structured data having a plurality of fields. A plurality of value combinations is generated for the plurality of fields using a statistical combination function. Each combination of the generated plurality of value combinations is stored as a separate entry in a results table. The entry in the results table includes a counter associated with the stored combination. A value of the counter is incremented for every occurrence of the stored combination in the generated plurality of value combinations. The results table is sorted based on the counters' values and based on a number of fields in each combination. One or more entries having highest counter values are identified in the results table.

Algorithmically detecting malicious packets in DDoS attacks

A computer method and system for determining patterns in network traffic packets having structured subfields for generating filter candidate regular expressions for DDoS attack mitigation. Stored packets are analyzed to extract a query name for each stored packet. Each query name is segregated into subfields. A Results-table is generated utilizing the segregated subfields of the query names. A Field-length table is generated that contains the length of the Field Values (Field-length) for each Field Name and an associated counter indicating how many instances the Field-length for a Field Name is present in the extracted query names. The Field-length table is analyzed to determine patterns of equal length in the 'Results' table. Utilizing the Patterns table, unique combinations of the Field Values are generated as a filter candidate regular expression for DDoS attack mitigation purposes.

System and method for detecting patterns in structured fields of network traffic packets

A method of automated filtering includes receiving a network traffic snapshot having packets with data stored in respective fields, generating a statistical data structure storing each potential unique combination of data stored in respective fields with an associated counter that is incremented for each occurrence that the combination matches one of the packets of the network traffic snapshot and one or more observation timestamps. Determining an observed vector from the statistical data structure, wherein the observed vector has associated attribute/value pairs and counters that satisfy a predetermined criterion. The observed vector's attribute/value pairs are compared to known attribute/value pairs associated with known DDoS attack vectors of an attack vector database. In response to finding a matching known attack vector as a result of the comparison, mitigation parameters associated with the known attack vector are selected and used for applying a countermeasure to the network traffic for mitigating an attack.

Automated selection of DDoS countermeasures using statistical analysis

A system and method for detecting a Denial of Service (DoS) attack. A number of evaluator elements (M) is determined for DoS analysis for network connection requests wherein each evaluator element is preferably associated with a component of the analyzed connection request. A DoS evaluator element score is determined for an evaluator element of the connection request by analyzing the evaluator element. DoS mitigation actions may be performed on the connection request if the determined evaluator element score is indicative of a DoS attack. An evaluator consolidated score (which may be weighted) is then calculated preferably consisting of one or more of the respective DoS evaluator element scores. Next, a determination is made as to whether each evaluator element of the M evaluator elements has been analyzed for determining a respective DoS evaluator element score. If no, a DoS evaluator element score for a succeeding evaluator element to be analyzed is then determined. And if yes, a determination is then made as to whether the value of the evaluator consolidated score is indicative of a DoS attack by the subject analyzed network connection request.

Detecting and mitigating application layer DDoS attacks

Automatic detection of malicious packets in DDoS attacks using an encoding scheme

A method of detecting patterns in network traffic is provided. The method includes receiving a plurality of packets of network traffic, each packet having a payload populated with payload data and selecting payload lengths that occurred most frequently. For each of the selected payload lengths, a pattern template is generated using characters per position of the payload that satisfy a frequency criterion. A bit encoding scheme is assigned for each of the selected payload lengths and its associated pattern template. Each packet of the plurality of packets that has a payload length equal to any of the selected payload lengths and payload content that matches a pattern template generated for the payload is encoded into a single value. The single value uses the bit encoding scheme for the payload length and the pattern template matched. Each potential combination of fields representing the respective payload length and the pattern template is stored, with either all bits set per field when the field is active or no bits set per field when the field is inactive. A bitwise operation is performed on each encoded packet with the stored potential combinations. Results of the bitwise operation are stored in a sparse memory array. The results of the sparse array are sorted based on a number of the active fields and a number of occurrences of the respective results of the bitwise operation. The results of the sorting are provided to a mitigation device as an indication of whether an attack is underway and/or what type of attack is underway.

Statistical automatic detection of malicious packets in DDoS attacks using an encoding scheme associated with payload content

Neighbor discovery is used to create a generic trust database for other applications. As part of the neighbor discovery, each device performs classification and validation of the credentials of the neighboring devices. The credentials and validation results are stored locally without having to perform a separate authentication step. The trust database is created and maintained as a neighbor table with the results of the validation. The generic trust database may then be consulted by other protocols. The neighbor discovery may use any of various underlying protocols, but the resulting table unifies the results such that other applications or protocols may take advantage of the secured identity without having to implement their own discovery process. Both discovery and validation may be implemented locally without relying on centralized servers. Manual configuration may be avoided.

Growing community of inventors

Fjerdingby, Norway

Steinthor Bjarnason