Systems and methods for automatically selecting an access control entity to mitigate attack traffic
AssigneeAkamal Technologies, Inc.
InventorsBonita G. Lee, Christopher Bero
Life of this patent
Estimating the term…
Abstract
The methods and system described herein automatically generate network router access control entities (ACEs) that are used to filter internet traffic and more specifically to block malicious traffic. The rules are generated by an ACE engine that processes incoming internet packets and examines existing ACEs and a statistical profile of the captured packets to produce one or more recommended ACEs with a quantified measure of confidence. Preferably, a recommended ACE is identified in real time of the attack, and preferably selected from a library of pre-authored ACEs. It is then deployed automatically or alternatively sent to system personnel for review and confirmation.
Claims14
A method of automatically selecting rules to install in a network protection device to mitigate an attack in real-time or near real-time, the method operable in at least one computer comprising at least one hardware processor and memory storing computer instructions for execution on the at least one hardware processor, the method comprising:
- receiving an attack profile with a plurality of traffic attributes, other than source IP address, that describe observed network traffic in a network attack;
- receiving a plurality of descriptions of rules for filtering network traffic, said rules having been previously created for addressing other network attacks that occurred prior to observation of the network attack;
- where each of the plurality of descriptions of rules comprises:
- a list of one or more traffic attributes other than source IP address that appear in a corresponding rule, such that each of the plurality of descriptions of rules is associated with the corresponding rule but is distinct therefrom;
- scoring each of the plurality of descriptions of rules based at least in part on common traffic attributes with the attack profile;
- and,
- by comparing scores for the plurality of descriptions of rules, selecting one or more of the rules for installation in a network protection device to filter against the network attack in real-time or near real-time.
An apparatus that automatically selects rules to install in a network protection device to mitigate an attack in real-time or near real-time, the apparatus comprising at least one computer comprising at least one hardware processor and memory storing computer instructions for execution on the at least one hardware processor to operate the apparatus to:
- receive an attack profile with a plurality of traffic attributes, other than source IP address, that describe observed network traffic in a network attack;
- receive a plurality of descriptions of rules for filtering network traffic, said rules having been previously created for addressing other network attacks that occurred prior to observation of the network attack;
- where each of the plurality of descriptions of rules comprises:
- a list of one or more traffic attributes other than source IP address that appear in a corresponding rule, such that each of the plurality of descriptions of rules is associated with the corresponding rule but is distinct therefrom;
- score each of the plurality of descriptions of rules based at least in part on common traffic attributes with the attack profile;
- and,
- by comparing scores for the plurality of descriptions of rules, select one or more of the rules for installation in a network protection device to filter against the network attack in real-time or near real-time.
A non-transitory computer readable medium holding computer program instructions for execution on one or more hardware processors, the computer program instructions comprising instructions for:
- receiving an attack profile with a plurality of traffic attributes, other than source IP address, that describe observed network traffic in a network attack;
- receiving a plurality of descriptions of rules for filtering network traffic, said rules having been previously created for addressing other network attacks that occurred prior to observation of the network attack;
- where each of the plurality of descriptions of rules comprises:
- a list of one or more traffic attributes other than source IP address that appear in a corresponding rule, such that each of the plurality of descriptions of rules is associated with the corresponding rule but is distinct therefrom;
- scoring each of the plurality of descriptions of rules based at least in part on common traffic attributes with the attack profile;
- and,
- by comparing scores for the plurality of descriptions of rules, selecting one or more of the rules for installation in a network protection device to filter against the network attack in real-time or near real-time.
Dependencies are inferred from the claim text.