At&t Intellectual Property I, LP

Amazon Technologies, Inc.

At&t Intellecutal Property I, L.p.

Thomas Bradley Scholl

Richard Kwapniewski

Jennifer Lynne Joy

Markus Weber

Andrew Bruce Dickinson

Kushal Mall

Michael W Palladino

Aman M Shaikh

Richard Hazen Galliher, Iii

Jeremy Volkman

Bobby Brown

Jay Charles Borkenhagen

Richard M Lotz

Bradford Sachin Chatterjee

Jacobus Erasmus Van Der Merwe

Han Q Nguyen

Michael Phillip Czamara

John William Eichelberg

Peter John Hill

Dan Pei

Gregory O Harp

Donald M Smith

John E Shields

Matthew Dean Rehder

Paul A Stancik

Travis Steven Pepper

Samuel Joseph Mortimer

Eduardo Manuel Parra

Jonathan Phillibert

Kelly Anne Rooker

Alex Snoeren

Joseph James Lindsay

Fiachra John Groarke

Darshan Narayana Reddy

Eric Charles Briffa

Patrick Verkaik

Daniel J Rohrabaugh

Eric Jason Brandwine

Thomas A Volpe

Craig Wesley Howard

Yao Liu

Gagan Choudhury

Bijendra Singh

Douglas Brian Terry

Benjamin Warren Mercier

Kuo-Hui Liu

Harvo Reyzell Jones

Justin Oliver Pietsch

Kiran Kalkunte Seshadri

Simon S Zelingher

Leonard Thomas Tracy

Kari Ann O'Brien

Frederick David Sinn

Stephen Callaghan

Ashley Flavel

Eric Andrew Rubin-Smith

Dennis Marinus

Zachary J Hansen

Edward Crabbe

Aswatnarayan Raghuram

Seyed Arash Sadrieh

Julien Ridoux

Ali Khayam

Tahir Azim

Kuo-Hul Liu

Lewis Iain McLean

Sidath Manawadu

Andrew Robert Hassall

Grace Marie Hatamyar

Karthik Chandrashekar

Joan Barcelo Llado

Kenan Yang

Rajat Chaudhary

Nikhil Ashok Arjunagi

Robert Louis Mosher

Nina Forsyth

Colm Gearöid MacCárthaigh

Benjamin Patrick Albertson-Gass

Thomas William Bray

Christopher Jason Brown

Sasha Robbins

Ibn Wendell Archer

Cheng-Jia Lai

Madhura Kale

Matt Chung

Blake Hoelzel

Michael Marano

Mario Souza

Valentin Iulian Neacsu

Keerthi Krishnan

Suresh Ambalavanan

Ahmed Negm

Christine Estefania Morales Hernandez

Technologies are disclosed for mitigating attempts to capture traffic on a network using unauthorized advertisements. Responsive to detecting an authorized advertisement for a path to a service on the network, a mitigation/orchestration service may determine a synthetic route advertisement that is configured to win back the captured traffic (e.g., by providing a route specificity that is at least equal to the unauthorized advertisement) and propagate the synthetic route advertisement from routers in the network. The won back traffic may be directed through a backbone of the network to the service.

Route hijack mitigation

In a computer networking system, data is transmitted through a network based on advertised routes. The disclosure provides mechanisms for detecting anomalies in network routing by analyzing autonomous system (AS) paths in data corresponding to Border Gateway Protocol (BPG) messages. The AS path information from the BGP message data may be evaluated to detect different types of anomalies, which may be reported to a management entity for further review or mitigation.

Network routing anomaly detection

A system can determine by which path/tunnel an Internet destination can be best reached for a user with an IP address from a static BGP range. The system looks up the destination address in an egress map. This map can either specify a tunnel that should be used for encapsulation for static BGP, or (when tunnel is not present) cause the system to send out unencapsulated traffic, in which the traffic follows normal BGP routing on a border network.

Routing for static border gateway protocol

The present disclosure generally relates to systems and methods for utilization of network mitigation techniques in the form of null address routing to mitigate coordinated DDOS attacks. One or more computing devices can install malware code into a network device after exploiting a vulnerability of the network device. A monitoring and mitigation service can monitor network devices and detect malware code installed on the network-based service. The monitoring and mitigation service can identify the internet protocol (IP) address or any routing information regarding the computing devices that sent the malware code. Based on the identified information, the monitoring and mitigation service can identify and implement the network mitigation information in the form of null routing addresses that will cause network communications associated with the identified computing device to be terminated or otherwise not delivered to the intended network-based resources.

Mitigation of malware code-distribution sites

Technologies are disclosed for performing context-aware routing of traffic based on an application of a series of filters and/or selectors to determine an optimal group of interfaces for servicing traffic relating to a prefix. A traffic management control plane processes input data corresponding to aggregated telemetry data for a network by determining candidate groups of interfaces to service a network prefix and applies tunable filters and/or selectors to the candidate groups to determine a targeted group to use for servicing traffic corresponding to the prefix. The determined targeted group is mapped to the prefix in a mapping result, which is then provided to an actuator interface to control network devices to inject the new mapping into the network to control traffic according to the mapping.

Network traffic management

The present disclosure generally relates to systems and methods for utilization of network mitigation techniques in the form of null address routing to mitigate coordinated DDOS attacks. A monitoring and mitigation service can characterize a command and control node as compromised or otherwise manipulated for purposes of generating distributed attacks. The monitoring and mitigation service can then identify network mitigation information in the form of null routing addresses that will cause network communications associated with the identified command and control node to be terminated or otherwise not delivered to the intended network-based resources. The monitoring and mitigation service can propagate the null routing address to routing components. The network mitigation information can be associated with expiration criteria for the routing components that receive and implement the network mitigation technique.

Managing network mitigation techniques

A detection mechanism is disclosed for identifying peers transmitting network traffic towards a cloud provider using routing prefixes that were not advertised for that peer. Once detected, an alarm condition can occur and the peer notified to remove any static route configurations. In one embodiment, a collector server computer can be used to acquire routing prefixes advertised to a peer. A second server computer can be used to obtain network traffic received from the peer. A comparison can then be made between the advertised prefixes and the network traffic being received. If network traffic is being received for unadvertised prefixes, then an alarm condition can occur. The detection mechanism can regularly inspect active traffic flows against BGP route advertisements at fixed intervals. For peers that are identified that are not in compliance with route advertisements, the alarm condition can occur for follow-up remediation.

Detecting static routes in a network

A reverse network tracing mechanism is described. In an embodiment, a network information request is received that is addressed to a predetermined destination. It is determined that the network information request has an expired timer and a message is returned indicating that a return network path routing procedure has been initiated. After determining that the network information request has an unexpired timer, contents of the network information request are modified to enable identification of at least a portion of the return path from the predetermined destination to a source address of the network information request.

Return path trace

Probe packets are transmitted from a source network to an external network to validate that the external network is accepting network prefix announcements to be loaded into forwarding tables of routers of the external network to ensure network connectivity. The network prefix announcements can be Border Gateway Protocol (BGP) announcements transmitted from the source network to the external network during a BGP peering session. After announcing a network prefix announcement, the source network can transmit a probe packet having a destination address in a range associated with the announced network prefix to the external network. An edge router of the source network can monitor incoming packets using an ingress Access Control List (ACL) to detect whether the probe packet returns, and if so, validate that the network prefix announcement was successful. If the probe packet does not return, an alert can be generated and/or remedial actions can be taken.

External network route advertisement validation

A data delivery service of a service provider may receive respective job specifications for different data transfer jobs between computing infrastructure collections (e.g., data centers). A job specification for a data transfer job may include an amount of data to be transferred for the data transfer job, one or more destinations of data transfers for the data transfer job, and/or one or more flexibility parameters for successful transfer of the data for the data transfer job (e.g., a deadline to transfer the data, available data delivery techniques). The data delivery service may determine a schedule for performing different data transfer jobs between two or more infrastructures based on an analysis of the amount of data to be transferred for each job, the destinations of the data transfer for each job, the flexibility parameters for each job (e.g., included in the respective job specifications), and the connectivity between computing infrastructure collections.

Flexible scheduling of data transfers between computing infrastructure collections for efficient resource utilization

The following description is directed to encrypting the characteristics of network traffic. In one example, a method can include receiving an unencrypted link layer packet including a first payload of a first size. The method can include encrypting the first payload of the unencrypted link layer packet. The method can include generating an encrypted link layer packet including a second payload. The second payload can include the encrypted payload and a variable length padding field so that the second payload of the encrypted link layer packet is a different size than the first size of the first payload. The encrypted link layer packet can then be transmitted.

Obscuring network traffic characteristics

The following description is directed to managing a hierarchical network including one or more network zones. In one example, a method of managing a hierarchical network includes collecting network state from respective devices of a network zone; using the collected network state to build an aggregated topology of the network zone; and transmitting the aggregated topology of the network zone to a traffic engineering service.

Managing a hierarchical network

A power distribution system includes two or more power components that distribute power to one or more electrical components. At least some of the power components send and receive signals over power transmission lines to upstream or downstream power components in the power distribution system. The signals include information about power components in the power distribution system.

Power distribution system discovery

A fast reroute (FRR) implementation utilizes an optimized FRR table to implement a fast switchover to a backup link upon detecting a primary link failure on a label switched path (LSP). The switchover can be performed in a negligible amount of time (close to zero milliseconds) based on a backup indicator flag which can be dynamically updated. The FRR table stores pre-determined backup egress interfaces and FRR labels corresponding to primary egress interfaces to minimize the switchover time.

Robust fast re-routing for label switching packets

Growing community of inventors

Seattle, WA, United States of America

Thomas Bradley Scholl