Arbor Networks, Inc.

A computer method and system for determining patterns in network traffic packets having structured subfields for generating filter candidate regular expressions for DDoS attack mitigation. Stored packets are analyzed to extract a query name for each stored packet. Each query name is segregated into subfields. A Results-table is generated utilizing the segregated subfields of the query names. A Field-length table is generated that contains the length of the Field Values (Field-length) for each Field Name and an associated counter indicating how many instances the Field-length for a Field Name is present in the extracted query names. The Field-length table is analyzed to determine patterns of equal length in the “Results” table. Utilizing the Patterns table, unique combinations of the Field Values are generated as a filter candidate regular expression for DDoS attack mitigation purposes.

A computer method and system for determining a threat level score for a detected network attack. Network data is received having a detected network attack, which is then analyzed to determine metadata associated with the network attack. The determined metadata associated with the network attack is analyzed to determine: 1) an attack objective component; 2) an attack method component; and 3) an attack execution component, each being associated with the network attack. A severity score value for the network attack is then determined based upon calculating a weighted value for each of the: 1) an attack objective component; 2) a attack method component; and 3) an attack execution component. And an alert signal/message is then generated for a network attack based upon the determined severity score value.

A method of monitoring a network during a DDoS attack is provided. The method includes receiving packets included in the attack, determining whether the packets are designated for tarpitting, for each packet from a source determined to be designated for tarpitting, assigning the packet to an existing or newly established flow, applying at least one tarpitting technique, and applying a randomization function for adjusting the at least one tarpitting technique or for selecting the at least one tarpitting technique to be applied from a plurality of candidate tarpitting techniques.

A computer implemented method system for obscuring the status of a network service provided by a network device. Received in a network monitoring device is network packet request message intended for a network device. The network monitoring device analyzes the received network packets request to determine whether the received network packet request is a DDoS network probe packet request. If the received packet request was determined to be a DDoS network probe packet requests, a response is generated and sent from the network monitoring device to the device that sent the DDoS network probe packet request indicating a faux degradation of service level for the intended network device.

An authenticating method including storing internally a reference hash set having hashes of genuine client binary and/or library files. The method further includes receiving an authentication request for authentication of the client process to authorize the client process to access a server resource provided by the server process. In a first phase, the method further includes requesting from the client OS, the process details and the hashes of the client binary and/or library files and verifying (using the reference hash set) these hashes received. In a second phase the method further includes, contingent on positive verification in the first phase, transmitting a random message to the client process by locating it using the IP address and PID presented during the authentication request, verifying a copy of the random message received back from the client process, and contingent on positive verification in the second phase, allowing the client process to access the requested server resource.

A computer-implemented method and system for managing and configuring flow specification (FlowSpec) messages for a customer network by a controller device coupled to the customer network. Network traffic is monitored by the controller device flowing through the customer network detect a network attack in the customer network. The controller device enables a network user to configure a Flowspec message responsive to the detected network attack. The controller device preferably enables the network user to either 1) manually configure a FlowSpec message or 2) configure a Flowspec message utilizing one or more pre-existing FlowSpec rulesets preferably defined for that customer network. The controller device then enables the network user to either 1) display to the network user the mitigation actions to be performed by the configured Flowspec message and save the configured Flowspec message in a data repository without announcement of the configured Flowspec message to the customer network; or 2) announce the configured Flowspec message to the customer network and save the configured Flowspec message in a data repository responsive to selection by the network user.

A method and network are provided for monitoring a network during a DDoS attack. The method includes establishing a flow record for flows designated for tarpitting and a state machine, each state of multiple states of the state machine having an associated handler function. The handler function associated with a current state of a state machine associated with a flow is invoked to perform one or more actions associated with the flow or the flow record for applying at least one tarpitting technique of one or more candidate tarpitting techniques associated with the flow record, and return a next state, which is used to update the current state of the state machine. The handler function associated with the current state of the state machine is repeatedly invoked, wherein each invocation of the handler function potentially applies different tarpitting techniques.

A computer method and system for determining patterns in network traffic packets having structured subfields for generating filter candidate regular expressions for DDoS attack mitigation. Stored packets are analyzed to extract a query name for each stored packet. Each query name is segregated into subfields. A Results-table is generated utilizing the segregated subfields of the query names. A Field-length table is generated that contains the length of the Field Values (Field-length) for each Field Name and an associated counter indicating how many instances the Field-length for a Field Name is present in the extracted query names. The Field-length table is analyzed to determine patterns of equal length in the “Results” table. Utilizing the Patterns table, unique combinations of the Field Values are generated as a filter candidate regular expression for DDoS attack mitigation purposes.

A computer method and system for mitigating Domain Name System (DNS) misuse using a probabilistic data structure, such as a cuckoo filter. Intercepted is network traffic flowing from one or more external hosts to a computer network, the intercepted network traffic including a DNS request that requests a Resource Record name in a DNS zone file. A determination is made as to whether the DNS request is requesting resolution at a protected DNS Name Server. A hash value is calculated for the requested Resource Record name if it is determined the DNS request is requesting resolution at the protected DNS Name Server. A determination is then made as to whether the calculated hash value for the requested Resource Record name is present in the probabilistic data structure. The DNS request is forwarded to the protected server if the requested Resource Record name is determined present in the probabilistic data structure.

A computer implemented method system for obscuring the status of a network service provided by a network device. Received in a network monitoring device is network packet request message intended for a network device. The network monitoring device analyzes the received network packets request to determine whether the received network packet request is a DDoS network probe packet request. If the received packet request was determined to be a DDoS network probe packet requests, a response is generated and sent from the network monitoring device to the device that sent the DDoS network probe packet request indicating a faux degradation of service level for the intended network device.