Loading patent…
AssigneeRadware, Ltd.
InventorsEhud Doron, Nir Ilani, David Aviv, Yotam Ben Ezra, Amit Bismut, Yuriy Arbitman
Estimating the term…
A system and method for protecting cloud-hosted applications against hypertext transfer protocol (HTTP) flood distributed denial-of-service (DDoS) attacks are provided. The method includes collecting telemetries from a plurality of sources deployed in at least one cloud computing platform hosting a protected cloud-hosted application; providing at least one rate-based feature and at least one rate-invariant feature based on the collected telemetries, wherein the rate-based feature and the rate-invariant feature demonstrate behavior of at least HTTP traffic directed to the protected cloud-hosted application; evaluating the at least one rate-based feature and the at least one rate-invariant feature to determine whether the behavior of the at least HTTP traffic indicates a potential HTTP flood DDoS attack; and causing execution of a mitigation action when an indication of a potential HTTP flood DDoS attack is determined.
A method for protecting cloud-hosted applications against hypertext transfer protocol (HTTP) flood distributed denial-of-service (DDoS) attacks, the method being performed by a defense system that is deployed out-of-path and comprising:
A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry of a defense system that is deployed out-of-path to perform a method for protecting cloud-hosted applications against hypertext transfer protocol (HTTP) flood distributed denial-of-service (DDoS) attacks, the method comprising:
A defense system for protecting cloud-hosted applications against hypertext transfer protocol (HTTP) flood distributed denial-of-service (DDoS) attacks, the defense system being deployed out-of-path and comprising:
A method for protecting cloud-hosted applications against transmission control protocol (TCP) flood distributed denial-of-service (DDoS) attacks, the method being performed by a defense system that is deployed out-of-path and comprising:
A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry of a defense system that is deployed out-of-path to perform a method for protecting cloud-hosted applications against transmission control protocol (TCP) flood distributed denial-of-service (DDoS) attacks comprising:
A defense system for protecting cloud-hosted applications against transmission control protocol (TCP) flood distributed denial-of-service (DDoS) attacks, the defense system being deployed out-of-path and comprising:
Dependencies are inferred from the claim text.
Drawings are temporarily unavailable. Open the PDF at USPTO
From the US filing history. Foreign family members aren’t listed.
Countermeasures against malicious traffic: denial of Service
For separating internal from external traffic, e.g. firewalls: architectural arrangements, e.g. perimeter networks or demilitarized zones
For controlling access to devices or network resources: access control lists [ACL]
By monitoring network traffic: event detection, e.g. attack signature detection
About 12 years 7 months of term left · ends 24 May 2039 (estimated)
This disclosure relates generally to cyber-security systems and, more specifically, to techniques for the detection of flood type DDoS attacks in an out-of-path environment.
With the increasing use of computers in modern society, computer systems have become increasingly subject to cyber-attacks intended to disrupt systems, steal data, cause application defacement, manipulate behavior, or a combination of these goals. Accordingly, the field of cyber security has developed to combat such cyber-attacks. Cyber security is particularly important in cloud computing platforms, where multiple computer resources interact remotely in order to provide services, e.g., sharing of files and applications. Organizations have increasingly adapted their applications to be run from multiple cloud computing platforms, either completely or via hybrid implementations (i.e., such that part of the application is implemented on the premises of an enterprise data center and another part of the application is hosted in one or more public cloud networks). This makes the defending of public cloud-hosted applications much more complex, as the applications are hosted in multiple public cloud locations.
Some leading public cloud service providers include Amazon®, Microsoft®, Google®, Oracle®, Hewlett-Packard®, and so on. To ensure their services are not interrupted, these service providers must protect their customers against cyber security threats. In most cases, providers offer solutions to protect their infrastructure against cyber-attacks.
The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the disclosed embodiments will be apparent from the following detailed description taken in conjunction with the accompanying drawings.
FIG. 1 is a network diagram of a multi-cloud architecture utilized to describe the various disclosed embodiments
FIG. 2 is a network diagram illustrating deployment of a defense platform according to an embodiment.
It is important to note that the embodiments disclosed herein are only examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily limit any of the various claimed embodiments. Moreover, some statements may apply to some inventive features but not to others. In general, unless otherwise indicated, singular elements may be in plural and vice versa with no loss of generality. In the drawings, like numerals refer to like parts through several views.
Some embodiments disclosed herein include a system and method for detecting flood DDoS attacks, and, in particular, HTTP and TCP flood DDoS attacks. In an embodiment, the disclosed method and system protects cloud-hosted applications or web-hosted applications (hereinafter “protected applications” or “a protected application”) hosted in a cloud computing infrastructure. A protected application may be distributed in multiple cloud-computing platforms and/or data centers located at the customer premises.
The protection is performed in an out-of-path deployment, that is, traffic directed to the protected application is neither received nor processed by the disclosed system. In an embodiment, the detection is based on a set of rate-based and rate-invariant features extracted from telemetries received from multiple sources. The telemetry relates to the protected application incoming and outgoing applicative behaviors, i.e., the behavior of the protected application.