Verisign, Inc.

Telefonaktiebolaget Lm Ericsson (publ)

Suresh Bhogavilli

Yujie Zhao

Roberto Guimaraes

Sivasankar Subramanian

Samir Shah

Frank Scalzo

Anupam Kulkarni

Kaarthik Sivakumar

Yannis Labrou

Glen S Wiley

Mahmood Hossain

Ramin Ali Dousti

Ramakant Pandrangi

Steven Bowers

Christopher Michael Sherwin

Chirayu Shah

Mark Teodoro

Kevin Purser

Han Zhang

Sanjay Rao

Roberto Rodrigues

Christopher Sherwin

Various embodiments of the invention disclosed herein provide techniques for mitigating a distributed denial of service (DDoS) attack on a targeted computer system. A border gateway protocol (BGP) controller receives, via a first router, a BGP message that includes an indicator indicating that a computer system associated with the first router is under a DDoS attack. In response to receiving the BGP message, the BGP controller, in performs one or more operations to mitigate the DDoS attack. As a result, the time between detection of a DDoS attack and mitigating the attack is reduced relative to prior approaches. After receiving the BGP message indicating a DDoS attack is in progress, the DDoS attack mitigation platform automatically takes steps to mitigate the DDoS attack without further manual intervention. Consequently, the targeted computer system recovers more quickly and begins to respond to legitimate network requests sooner relative to prior approaches.

Automated DDOS attack mitigation via BGP messaging

Methods and systems for detecting and responding to Denial of Service ('DoS') attacks comprise: detecting a DoS attack or potential DoS attack against a first server system comprising one or more servers; receiving, at a second server system comprising one or more servers, network traffic directed to the first server system; subjecting requesting clients to one or more challenge mechanisms, the challenge mechanisms including one or more of challenging requesting clients to follow through HTTP redirect responses, challenging requesting clients to request Secure Sockets Layer (SSL) session resumption, or challenging requesting clients to store and transmit HTTP cookies; identifying one or more non-suspect clients; and forwarding, by the second server system, traffic corresponding to the one or more non-suspect clients to the first server system. Once a client has been validated, clients may communicate directly with application servers in a secure manner by transparently passing through intermediary proxy servers.

Active validation for DDoS and SSL DDoS attacks

A method for mitigating a denial of service attack includes determining, for a client, a number of requests being transmitted to a server and determining, for the client, that the number of requests for a time period is greater than a top talker threshold. The method includes classifying the client as a top talker based on the number of requests being greater than the top talker threshold and identifying, for the client, additional requests being transmitted to the server. The method also includes determining whether a number of the additional requests matches one or more attack patterns and preventing one or more of the additional requests from being transmitted to the server if the number of additional requests that matches one or more attack patterns is greater than a first threshold.

Techniques for automatically mitigating denial of service attacks via attack pattern matching

Embodiments relate to systems, devices, and computing-implemented methods for providing DoS mitigation using a list of persistent clients generated using network flow data. Daily flow counts can be incremented once per date for unique flow combinations in the network flow data that are associated with at least one network interaction that occurred on that date. A candidate list of persistent clients can be created based on the daily flow counts, and the candidate list of persistent clients can be filtered and ranked, and the list of persistent clients can be selected based on the rankings.

Systems, devices, and methods for improved network security

In one embodiment, a rule optimization application optimizes a rule set that a firewall applies to protect web applications from on-line attacks. The rule optimization application identifies a completed filtering operation that is associated with applying a rule to a request to access a web application received from a client. The rule optimization application then estimates a quality score for the rule based on the completed filtering operation and a reputation value for the client that indicates a likelihood that the client is legitimate. Subsequently, the rule optimization application determines that the quality score does not satisfy a predetermined quality criterion and disables the rule in the rule set to generate a updated, optimized rule set for the web application. Advantageously, the quality criterion may configure the rule optimization application to automatically update the rule set to reduce the number of legitimate requests that are blocked by the rule set.

Automatically optimizing web application firewall rule sets

Methods and systems for mitigating denial-of-service attacks include a proxy server that monitors a set of application servers configured to receive and service requests from clients. The proxy server intercepts the requests, and in response, provides the clients with customized client-side scripts embedded in markup language. The client-side scripts may include random strings to generate follow-through random uniform resource identifier redirection requests expected by the proxy server. The client-side scripts, upon execution, may challenge the clients by demanding user interaction within a specified period of time, requesting a delay before responding, and/or attempting to set a challenge cookie multiple times. If a client provides the demanded user interaction within the specified time, honors the delay, and/or sets the challenge cookie with the correct value, then the client-side scripts may generate a redirection request expected by the proxy server for that client and the proxy servers may whitelist that client for a configurable duration and forward that client's subsequent requests to the application servers without challenge.

Client-side active validation for mitigating DDOS attacks

A mitigation service can monitor network traffic in one direction between a client computer and a server computer. The mitigation service can receive a request from a client computer to establish a network connection with a server computer. The mitigation service can reply to the client computer with an acknowledgment that is configured to cause the client computer to issue a request to reset the connection. The acknowledgement is configured not to affect the establishment of the network connection with the server computer. The mitigation service can compare the details of the reset request with the request to establish the network connection. If the details match, the mitigation service can forward the request to establish the network connection to the server computer.

Systems and methods for transparently monitoring network traffic for denial of service attacks

Embodiments relate to systems, devices, and computer-implemented methods for mitigating Distributed Denial of Service ('DDoS') attacks. The method can include receiving, by a server, a response message from an application server. The method can further include determining a source internet protocol (IP) address associated with the source client based on a request message received from a source client. The request message received from the source client corresponds to the response message received from the application server. In addition, the method can include identifying, by the server, a plurality of counters associated with the source IP address, and identifying, by the server, a response type of the response message. Further, the method can include causing a value of at least one of the plurality of counters to change based on the response message and the response type.

Systems and methods to detect and respond to distributed denial of service (DDoS) attacks

A method for passing data from a first processing thread to a second processing thread, wherein the first processing thread produces data to be processed by the second processing thread. The data from the first processing thread may be inserted into objects that in turn are inserted into a queue of objects to be processed by the second thread. The queue may be a circular array, wherein the array includes a pointer to a head and a pointer to a tail, wherein only the first processing thread modifies the tail pointer and only the second processing thread modifies the head pointer.

Lockless queues

A system and method for managing a route cache to reduce the risk of disruption from denial of service attacks. All traffic arriving on a front interface from local (on-link) nodes (e.g., neighbor nodes) can be treated normally. However, for packets arriving from remote (off-link) sources addressed to a given destination IP address, a single, shared route cache entry can be used. The source-address field in this entry can be zeroed-out since it will not be used for traffic coming from any one source. Similarly, for all packets going to off-link destinations through the front-interface, another single shared route cache entry can be created and used. The destination-address field in this entry can be zeroed out since it will not be used for traffic going to any one destination.

Method for optimizing a route cache

A system and method for improving network performance when communicating between a first site network and a second site network via an IP-based transport network. The site networks include a LAN, a plurality of host/media gateways (MGWs) connected to the LAN, and pairs of first and second Site Edge Routers (SERs) connected to the LAN for handling traffic from different host/MGWs. The SERs are configured as redundant backup pairs in which each SER in a given pair backs up the other SER in the pair. Each SER is connected to a different Provider Edge (PE) router in the transport network via a dedicated link that has sufficient spare capacity to carry traffic coming from both of the SERs in a given pair of SERs in case one of the SERs fails. The SERs provide preferred routing prefixes to the PE routers, thereby guaranteeing symmetric paths for bidirectional traffic.

System and method for achieving path symmetry in an internet protocol (IP) based network

A router and a method for migrating routing protocol processes or Virtual Routers (VRs) from one Route Processor (RP) to another using graceful restart procedures for maintaining packet flow to the router and assisting the router to obtain restart information. The router includes first and second RPs and a forwarding engine for forwarding packets to neighbor routers in the network. When the routing protocol process is terminated on the first RP, the neighbor routers detect a router failure and initiate the graceful restart procedures. A filter rule in the forwarding engine causes it to forward packets to the new routing protocol process on the second RP. The new process learns the network topology from the neighbor routers, and the migration is completed without packet loss and without requiring complex changes to the network protocol stack.

Router and method for protocol process migration

Providing resiliency for mobile terminal data sessions, wherein the data sessions rely on Internet Protocol Version 4 and wherein at least one Home Agent node maintains a mobility bindings database for all registered mobile terminals while they are away from a home network. A first aspect of the invention provides physical Home Agent redundancy, perceived by each mobile node as Home Agent IP address redundancy, and a second aspect provides session resiliency. While the second aspect of the invention provides for session resiliency, it uses a mechanism of the former for master failure detection and Home Agent IP address take-over by a backup Home Agent.

Growing community of inventors

Gaithersburg, MD, United States of America

Suresh Bhogavilli