F5 Networks, Inc.

F5, Inc.

Yaniv Shemesh

Ron Talmor

David Stav

Shlomo Yona

Itsik Mantin

Mark Ernest Quevedo

Ziv Rika

Bryan Appleby

Itai Tenenbaum

Ranjeet Sonone

Hadasa Dorfman

A method, non-transitory computer readable medium and device that assists with preventing distributed denial of service attack includes receiving a request for a web resource from a client computing device. The received requested for the web resource is determined for presence of referrer header information. When the received request is determined to include the referrer header information, then the referrer header information is checked whether it includes a known domain and a valid cookie associated with the known domain. A distributed denial of service attack is prevented by providing a proactive challenge to the requesting client computing device when received request for the web resource does not include the referrer header information or when the referrer header information comprises the known domain and does not include the valid cookie.

Methods for protecting web based resources from D/Dos attacks and devices thereof

A method, non-transitory computer readable medium, and device for analyzing network traffic and enforcing network policies includes analyzing network traffic data based on one or more network traffic rules. An attack on the network such as a current or predicted attack is determined based on the analysis. Next, one or more policy changes to a plurality of existing network policies are identified when the current or predicted attack on the network is determined to be present. The identified one or more policy changes are enforced on one or more client computing devices causing the determined current or the predicted attack on the network.

Methods for analyzing network traffic and enforcing network policies and devices thereof

Technology related to multi-device authentication is disclosed. In one example, a method can include receiving a request from a requesting client device to access a secured server. A command can be sent to an authenticating device to capture environmental information in proximity to the authenticating device. The captured environmental information can be used to verify the requesting client device and the authenticating device are near each other. The received request can be forwarded to the secured server in response to verifying the requesting client device and the authenticating device are near each other.

Multi-device authentication

Methods for protecting web based resources from D/DoS attacks and devices thereof

Methods, non-transitory computer readable media, anomaly detection apparatuses, and network traffic management systems that generate, based on the application of one or more models and for a first flow associated with a received first set of network traffic, one or more likelihood scores and at least one flow score based on the likelihood scores. One or more of the one or more models are associated with one or more browsing patterns for a web application to which the first set of network traffic is directed. A determination is made when the flow score exceeds a threshold. A mitigation action is initiated, based on a stored policy, with respect to the first set of network traffic, when the determining indicates that the flow score exceeds the established threshold.

Methods for detecting and mitigating malicious network behavior and devices thereof

Methods, non-transitory computer readable media, network traffic management apparatuses, and network traffic management systems that receives a client access request to access content at one or more server devices. Fingerprint attributes associated with the client device are collected and utilized to identify potential fingerprints. Potential fingerprints are identified based on the collected fingerprint attributes. Previously validated fingerprints stored in a database are utilized to determine when the one of the potential fingerprints matches with one of a previously validated fingerprints stored in the database. The client device is authorized to access content requested in the client access request when the determination indicates that the one of the potential fingerprints matches with one of the plurality of previously validated fingerprints stored in the database.

Methods for dynamic computer network fingerprint matching and devices thereof

Methods, non-transitory computer readable media, and security management apparatus that retrieves a web page in response to a request for the web page received from a client device. Remote access trojan (RAT) malware detection source code is injected into the web page and the web page is sent to the client device in response to the request. The RAT malware detection client-side source code is configured to, when executed by a web browser of the client device, output an alert when a possible attack is detected based on monitored movement of a mouse pointer, key events, or executing animations. A determination is made when the alert has been received from the client device. A security action is initiated according to an established policy, when the determining indicates that the alert has been received from the client device.

Methods for detecting remote access trojan malware and devices thereof

Methods, non-transitory computer readable media, and security management computing devices are disclosed herein. With this technology, an executable code is sent to a client. The executable code is configured to obtain information associated with the client, assemble the information into a fingerprint, and return the fingerprint. A determination is made when the fingerprint is returned from the client. When the determining indicates that the fingerprint has been returned, a determination is made when a record of a reputation database matches the fingerprint. Historical data in the record is updated to include information associated with the request and an action is initiated based on the historical data or other data included in the record. The action includes blocking an access request or providing access to a requested resource to the client, when the determining indicates that the record of the reputation database matches the fingerprint.

Methods for utilizing fingerprinting to manage network security and devices thereof

A system for accelerating web page loading in a user client is provided. The system includes computing platform being in communication with the user client and being configured for changing object delivery/loading order or object rendering at the web browser, or bundling the objects into one or more bundles according to object use and change frequency.

Systems and methods for accelerating web page loading

Methods, non-transitory computer readable media, security management apparatuses, and network traffic management systems that send a web page to a client device in response to a received request for a web resource. The web page comprises injected capability analysis client-side code that is configured to obtain and return capability data for a web browser identified in a user agent header of the request. A response comprising the returned capability data is received and the returned capability data is compared with expected capability data for the web browser identified in the user agent header of the request. A score is generated based at least in part on the comparison and a determination is made when the score exceeds an established threshold. The web resource is retrieved and provided to the client device, when the determining indicates that the score exceeds the established threshold.

Methods for detecting malicious smart bots to improve network security and devices thereof

A method, non-transitory computer readable medium and device that assists providing a secure channel includes selecting a client-server key from a plurality of client-server keys based on an IP address of a client computing device and a time of receiving a request from the client computing device wherein the selecting further includes identifying an index value associated with the selected client-server key. Next, a context signature is generated based on the IP address of the client computing device, the time of receiving the request from the client computing device and the index value associated with the selected client-server key. Next, the generated context signature is encrypted using a stored private key. A secure channel is provided by preparing and sending a response including the selected client-server key and the encrypted context signature back to the client computing device.

Methods for providing a secure network channel and devices thereof

A method, non-transitory computer readable medium and device that assists obfuscating JavaScript includes obtaining a webpage requested by a client computing device. A determination of when javascript code is in the source code of the obtained webpage is made. A stored obfuscated javascript code is obtained when the javascript code is determined to be in the source code of the obtained webpage. The obtained obfuscated javascript code is embedded into the obtained webpage and the obtained webpage with the embedded obfuscated javascript code is sent to the requesting client computing device.

Growing community of inventors

Seattle, WA, United States of America

Yaniv Shemesh