Systems and methods for mitigating cyberattacks
AssigneeHewlett Packard Enterprise Development LP
InventorsYuanjie Li, Kyu-Han Kim, Qianru Li
Life of this patent
Estimating the term…
Abstract
Systems and methods for mitigating cyberattacks are described herein. A computing system can detect illegitimate network traffic associated with a cyberattack in network traffic. The computing system can determine an amplification factor of the cyberattack based in part on a probability distribution of the illegitimate network traffic. The computing system can determine a filter to demotivate a generation of the illegitimate network traffic. The determined filter can reduce the amplification factor of the cyberattack. The computing system can implement the determined filter to block the illegitimate network traffic.
Claims17
A computer-implemented method, the method comprising:
- detecting, by a computing system, illegitimate network traffic associated with a cyberattack in network traffic;
- determining, by the computing system, an amplification factor of the cyberattack based on a probability distribution of the illegitimate network traffic, wherein the amplification factor of the cyberattack correlates with a ratio between an amount of the illegitimate network traffic generated by hijacked client devices and an amount of the illegitimate network traffic generated directly by an attacker;
- determining, by the computing system, a filter to demotivate a generation of the illegitimate network traffic, wherein the filter reduces the amplification factor of the cyberattack;
- and
- implementing, by the computing system, the determined filter to block the illegitimate network traffic.
A computing system comprising:
- at least one processor;
- and
- a memory storing instructions that, when executed by the at least one processor, cause the computing system to perform a method, the method comprising:
- detecting illegitimate network traffic associated with a cyberattack in network traffic;
- determining an amplification factor of the cyberattack based on a probability distribution of the illegitimate network traffic, wherein the amplification factor of the cyberattack correlates with a ratio between an amount of the illegitimate network traffic generated by hijacked client devices and an amount of the illegitimate network traffic generated directly by an attacker;
- determining a filter to demotivate a generation of the illegitimate network traffic, wherein the filter reduces the amplification factor of the cyberattack;
- and
- implementing the determined filter to block the illegitimate network traffic.
A non-transitory storage medium of a computing system storing instructions that, when executed by at least one processor of the computing system, cause the computing system to perform a method, the method comprising:
- detecting illegitimate network traffic associated with a cyberattack in network traffic;
- determining an amplification factor of the cyberattack based on a probability distribution of the illegitimate network traffic, wherein the amplification factor of the cyberattack correlates with a ratio between an amount of the illegitimate network traffic generated by hijacked client devices and an amount of the illegitimate network traffic generated directly by an attacker;
- determining a filter to demotivate a generation of the illegitimate network traffic, wherein the filter reduces the amplification factor of the cyberattack;
- and
- implementing the determined filter to block the illegitimate network traffic.
Dependencies are inferred from the claim text.