F5 Inc

Methods, non-transitory computer readable media, network traffic management devices and network traffic management systems that provide for intelligent signaling message steering in 5G core are illustrated. With this technology, a network request is received and a set of features are identified. Based on the set of identified features and a failure probability table, a faulty producer network function (NFs) of a plurality of producer NFs can be identified. A subset of the plurality of NFs that does not include the faulty NF can be defined and the network request can be routed to one of the subset of the plurality of NFs. Accordingly, a network request can be routed away from a NF that, based on the features of the network request, has a relative high probability of resulting in a failure of processing the network request.

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with establishing a connection to a server with a certificate includes receiving a request for establishing an encrypted connection and obtaining a certificate responsive to the received request. Next, the network traffic manager apparatus generates a content cache key for the obtained certificate. Next, the network traffic manager apparatus retrieves a data structure in the cache using the generated content cache key for the obtained certificate. The retrieved data structure is generated and stored in the cache during a previous established encrypted connection. The data structure comprises of extracted data from a previous certificate. Then, the network traffic manager apparatus initiates encryptographic operations using the retrieved data structure from the cache.

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with migrating keys between a first hardware security system and a second hardware security system includes receiving an encrypted symmetric key from a first hardware security system. The symmetric key generated by the first hardware security system is encrypted using a public key generated from a second hardware security system. A generated public key is sent to the first hardware security system prior to encrypting the symmetric key. The received encrypted symmetric key is sent to the second hardware security system. An encrypted original key from the first hardware security system is received upon sending the encrypted symmetric key to the second hardware security system. The original key is encrypted using the symmetric key. The migration is completed when the second hardware security system decrypts the sent encrypted original key using the sent encrypted symmetric key.

Technologies related to mitigation of volumetric distributed denial of service attacks are disclosed. Malicious network connection request detection can be performed using a first network traffic management module (NTMM) that executes before network connection resources are allocated and a second NTMM that executes after connection resource allocation. The second NTMM can be used to determine whether a connection request is from a potential bad actor. If the request is from a potential bad actor, the second NTMM can add an identifier for the potential bad actor to a list of potential bad actors. When a subsequent connection request is received, the first NTMM can generate the identifier based on the subsequent request and determine whether it is stored in the list of potential bad actors. If it is, the first NTMM can drop the subsequent request before connection resources for establishing the second request are allocated.

A method, non-transitory computer readable medium, device and system intercepts a request for a webpage including a protected resource. The request is sent from a client device to a server device. One or more link tags or other mechanisms corresponding to one or more sub-resources included in the webpage are generated. The webpage is encrypted. An interstitial page is served to the client device that includes an encrypted portion that includes the encrypted webpage, an unencrypted portion that includes the link tags, and instrumentation code that collects telemetry data when executed at the client device. The telemetry data is received from the client device and a threat analysis is performed on the telemetry data. A decryption key is transmitted to the client device in response to determining that the request is allowed, based on the performed threat analysis. The decryption key allows the client device to decrypt the encrypted webpage.

Technologies related to malicious DNS request detection are disclosed. A DNS server can use a machine learning model to analyze DNS requests and to detect requests that are potentially malicious. The machine learning model can comprise a neural network (such as a convolutional neural network) that is trained using a corpus of known malicious and non-malicious DNS requests. Data included in a DNS request can be provided as input to a machine learning algorithm (such as a neural network algorithm) that uses the input data and the machine learning model to generate a prediction of whether the DNS request is malicious. If the DNS request is determined to likely be malicious then the request can be blocked (for example by providing a fake address in response to the DNS request). If the DNS request is determined to likely be non-malicious, then the DNS request can be allowed.

A method, non-transitory computer readable medium and device that assists with preventing distributed denial of service attack includes receiving a request for a web resource from a client computing device. The received requested for the web resource is determined for presence of referrer header information. When the received request is determined to include the referrer header information, then the referrer header information is checked whether it includes a known domain and a valid cookie associated with the known domain. A distributed denial of service attack is prevented by providing a proactive challenge to the requesting client computing device when received request for the web resource does not include the referrer header information or when the referrer header information comprises the known domain and does not include the valid cookie.

Technology related to sending data items via network links in a link aggregate group is disclosed. Data items (such as network packets received via a computer network) can be analyzed to determine whether the data items qualify for a relaxed transmission ordering. If a data item does not qualify for relaxed transmission ordering, then a network link in the link aggregate group can be selected based on contents of the data item (such as by generating a signature or key based on headers of the data item and selecting a network link based on the signature or key). However, if the data item does qualify for relaxed transmission ordering, then a network link in the link aggregate group can be selected based on available capacities of the network links (such as by selecting a network link with a largest available capacity).

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with mitigating DDoS attack using a hardware device includes determining when a received network packet in an established connection between a client and a destination server includes a connection identifier cookie. A connection validation cookie is generated based on at least data in the received network packet, when the determination indicates the received network packet includes the connection identifier cookie. The connection identifier cookie is compared against the generated connection validation cookie. The received network packet is dropped when the comparison indicates the connection validation cookie fails to match the connection identifier cookie.

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with optimizing selection from hardware security servers includes receiving data from candidate hardware security servers after sending an operation status request or a capability query to the candidate hardware security servers. The hardware security requirements can comprise of one or more server operation rules. Then, generating compliance scores for the candidate hardware security servers based on hardware security server requirements, built-in hardware security server requirements, and received data from the candidate hardware security servers. The method can then include generating a rank for the candidate hardware security servers based on the compliance scores of the candidate hardware security servers and providing the hardware security server recommendation for one of the candidate hardware security servers to the client based on the generated rank of the candidate hardware security servers with compliance scores above a predetermined threshold.