US 10,834,110 B1Granted

Methods for preventing DDoS attack based on adaptive self learning of session and transport layers and devices thereof

AssigneeF5 Networks, Inc.

InventorsSergei Edelstein, Michael Kapelevich, Shlomo Yona, Ron Talmor

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method, non-transitory computer readable medium, and device includes monitoring a session layer and transport layer network traffic data received from a plurality of client computing devices and plurality of servers. A plurality of network traffic anomaly threshold values and a plurality of server health anomaly threshold values for the monitored session layer and the transport layer network traffic data are estimated. Whether a plurality of current network traffic anomaly values and a plurality of current server health anomaly values for the monitored network traffic data exceeds each of the corresponding estimated plurality of network traffic anomaly threshold values and the estimated plurality of server health anomaly threshold values, and whether the current plurality of network traffic anomaly values and the current plurality of server health anomaly values are not a false anomaly is determined. A mitigation action is initiated based on the determination.

Claims20

Dependent claims

A method for mitigating distributed denial of service (DDoS) attack implemented by a network traffic management system comprising one or more network traffic apparatuses, client devices, or server devices, the method comprising:

monitoring network traffic data received from a plurality of client computing devices and plurality of servers;
identifying a current value corresponding to at least one of a plurality of network traffic attributes based on the monitored network traffic data, wherein the identifying further comprises setting a threshold value that satisfies a plurality of network rules for the at least one of the plurality of network attributes;
adjusting the determined threshold value corresponding to at least one of the plurality of network traffic attributes based on a sensitivity value determined based on a historical sensitivity value that corresponds to the at least one of the plurality of network traffic attributes;
identifying an anomaly in the monitored network traffic data when the identified current value exceeds the adjusted threshold value corresponding to the at least one of the determined plurality of network traffic attributes;
identifying a server health issue associated with at least one of the servers based on the identification of the anomaly in the monitored network traffic data;
and
initiating a mitigation action comprising providing a challenge request in response to a potential DDoS attack based on the identification of the issue in the server health associated with the at least one of the servers.

4 more elements

A non-transitory computer readable medium having stored thereon instructions for preventing distributed denial of service (DDoS) attack comprising executable code which when executed by one or more processors, causes the processors to:

monitor network traffic data received from a plurality of client computing devices and plurality of servers;
identify a current value corresponding to at least one of a plurality of network traffic attributes based on the monitored network traffic data, wherein the identifying further comprises setting a threshold value that satisfies a plurality of network rules for the at least one of the plurality of network attributes;
adjust the determined threshold value corresponding to at least one of the plurality of network traffic attributes based on a sensitivity value determined based on a historical sensitivity value that corresponds to the at least one of the plurality of network traffic attributes;
identify an anomaly in the monitored network traffic data when the identified current value exceeds the adjusted threshold value corresponding to the at least one of the determined plurality of network traffic attributes;
identify a server health issue associated with at least one of the servers based on the identification of the anomaly in the monitored network traffic data;
and
initiate a mitigation action comprising providing a challenge request in response to a potential DDoS attack based on the identification of the issue in the server health associated with the at least one of the servers.

4 more elements

A network traffic manager apparatus, comprising memory comprising programmed instructions stored in the memory and one or more processors configured to be capable of executing the programmed instructions stored in the memory to:

monitor network traffic data received from a plurality of client computing devices and plurality of servers;
identify a current value corresponding to at least one of a plurality of network traffic attributes based on the monitored network traffic data, wherein the identifying further comprises setting a threshold value that satisfies a plurality of network rules for the at least one of the plurality of network attributes;
adjust the determined threshold value corresponding to at least one of the plurality of network traffic attributes based on a sensitivity value determined based on a historical sensitivity value that corresponds to the at least one of the plurality of network traffic attributes;
identify an anomaly in the monitored network traffic data when the identified current value exceeds the adjusted threshold value corresponding to the at least one of the determined plurality of network traffic attributes;
identify a server health issue associated with at least one of the servers based on the identification of the anomaly in the monitored network traffic data;
and
initiate a mitigation action comprising providing a challenge request in response to a potential DDoS attack based on the identification of the issue in the server health associated with the at least one of the servers.

4 more elements

A network traffic management system, comprising one or more traffic management apparatuses, client devices, or server devices, the network traffic management system comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

monitor network traffic data received from a plurality of client computing devices and plurality of servers;
identify a current value corresponding to at least one of a plurality of network traffic attributes based on the monitored network traffic data, wherein the identifying further comprises setting a threshold value that satisfies a plurality of network rules for the at least one of the plurality of network attributes;
adjust the determined threshold value corresponding to at least one of the plurality of network traffic attributes based on a sensitivity value determined based on a historical sensitivity value that corresponds to the at least one of the plurality of network traffic attributes;
identify an anomaly in the monitored network traffic data when the identified current value exceeds the adjusted threshold value corresponding to the at least one of the determined plurality of network traffic attributes;
identify a server health issue associated with at least one of the servers based on the identification of the anomaly in the monitored network traffic data;
and
initiate a mitigation action comprising providing a challenge request in response to a potential DDoS attack based on the identification of the issue in the server health associated with the at least one of the servers.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/382,668Filed 18 Dec 2016 · us provisional application
Priority: 18 Dec 2015
Granted: 10 Nov 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 63/1458
Countermeasures against malicious traffic: denial of Service
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general