Akamai Technologies, Inc.

Systems and methods for improving a multi-tenant web firewall are disclosed. When network traffic violates a firewall rule, the firewall can communicate that event to an analyzer component. The analyzer checks the decision of the firewall by applying—to that same traffic—a machine learning model and/or a variety of additional rules. If the analyzer determines that the traffic is benign, meaning that the original decision was a false positive, then the analyzer triggers a rule generator that creates an exception to the firewall's ruleset, so as to allow such traffic going forward. The newly generated exception is sent for installation in the firewall. The analyzer and rule generation can be operated on a tenant by tenant basis, serving to improve each tenant's firewall ruleset independently of others.

A secret management infrastructure federates with a cloud compute platform to store, issue, track and revoke secrets issued to workload instances. A workload instance can be provisioned with a token and can present that token to the secret management infrastructure (SMI) in exchange for a credential. In addition to validating the token itself, the SMI can verify whether the workload instance is entitled to receive the credential based on label match. The label is typically workload operator defined and corresponds to one or more attributes that the workload instance must possess, particularly physical, hardware, or software attributes. Preferably the secret management infrastructure verifies that the workload instance matches the label (that is, it has the necessary attributes) from the control plane of the cloud compute platform, or other source independent of the workload instance.

A method, apparatus and computer program product provides for zero configuration service registration in association with a network-accessible infrastructure that hosts services on behalf of an enterprise. A service is required to be registered with an authority before being online. The technique is implemented in a network-based automated bootstrap mechanism. In operation, and responsive to a determination that a new service instance is required to be brought online, a determination is made whether a peer service instance has an existing registration with the authority and is active. If so, and without requiring manual intervention, that existing registration is then leveraged on behalf of the new service instance to automatically register that instance with the authority. After automatically register the new service instance, that instance is then executed in the network-accessible infrastructure. Several automated bootstrap mechanisms are described. In one embodiment, the service instance is a connector to an enterprise application.

The subject matter herein provides a platform and mechanism to enable dynamic control over data signal collection telemetry in a bot detection-based access control system executing, for example, in associated with a multi-tenant shared network infrastructure. The approach herein leverages the ability of a native SDK running in a mobile device application to launch and use a webview that controls the data collection process. The techniques make it harder for bad actors to send spoofed telemetry from their mobile devices to an overlay network edge platform having an associated bot detection system back-end.

A cloud provider implements a safety mechanism for links associated with its infrastructure. Link safety is achieved by changing how server and network capacity information is shared by the cloud provider with a customer entity that utilizes the infrastructure. To this end, the entity is provided information about defining a “mini-cluster” that is configured from a physical server cluster, and where the mini-cluster services only one particular link. A mini-cluster has one or more servers, typically virtual machines. The egress capacity of each of the servers within a mini-cluster is capped to match a maximum link capacity that is allocated to the customer entity's traffic. By dedicating a fixed set of servers to the link and capping the total server capacity to a maximum link size defined for a given customer, traffic provided by the customer entity's software system is controlled to prevent link overload.

The subject matter herein provides a platform and mechanism to enable dynamic control over data signal collection telemetry in a bot detection-based access control system executing, for example, in associated with a multi-tenant shared network infrastructure. The approach herein leverages the ability of a native SDK running in a mobile device application to launch and use a webview that controls the data collection process. The techniques make it harder for bad actors to send spoofed telemetry from their mobile devices to an overlay network edge platform having an associated bot detection system back-end.

Systems and methods for querying large amounts of data are disclosed. Several different versions of a data feed are provided, ranging from a full set of data to various other versions that are smaller or faster to query (e.g., sampled versions, aggregations, sketches). A machine learning model is trained on features of input queries run against the various versions of the data feed and the corresponding results. The trained model is then applied to a new query to choose, automatically, which version of the data feed to apply the query against. That is, the system can select which version of the data feed to use when executing the given query, optimizing speed and/or compute costs while providing an appropriate level of accuracy for the given query.

This disclosure describes techniques to distinguish between attack traffic and legitimate user traffic at a site and take action on those findings. A system monitors traffic volumes to the site to determine whether it falls within predicted levels based on historical patterns. If traffic volume deviates from predicted levels, then traffic is analyzed by client signatures (such as a tuple of operating system and user agent) to determine whether the deviation is due to a subset of client signatures rather than factors that are more broadly applicable across clients. A subset of client types driving increased traffic levels may indicate an attack. Based on this intelligence the system can take action to mitigate the traffic or, if legitimate traffic, adjust the general forecasting model.

A cloud computing platform provides virtual machines on-demand to users. The platform provides a service that enables the user to access and control their virtual machine via an out-of-band channel for administrative purposes. A user invokes this service by authenticating with a control center and receiving a URL that points to a content delivery network (CDN). The user follows the URL to connect to a particular CDN server, per the CDN's request routing architecture. The CDN server applies instructions for handling this cloud compute platform URL, thereby decrypting an encrypted token in the URL to find, e.g., a network locator pointing to the host that is currently hosting the user's virtual machine, as well as an identifier for the user's virtual machine, and authenticators. The CDN server goes forward to the host, connecting to an endpoint which in turn connects to the user's virtual machine to provide the service.

A bot detection service associated with an overlay network operates to score traffic as a probability of being a bot, as opposed to returning a binary classification (i.e., bot or human). According to the approach herein, scoring is determined through probability estimates, wherein a score (the probability) is based on considering a set of detections concurrently. In one embodiment, all (or substantially all) triggered (current) threat detections contribute to the score. The preferred approach penalizes requests that fail all (or substantially all) combinations of detection algorithms. According to a further feature, an automated tuning (autotuning) is also applied, e.g., using real-time empirical statistical models, to adapt the measurement of false positive probability for one or more threat detection algorithms to suit customer traffic trends. The approach herein is also extensible to include any number of future threat detection algorithms.