# US 12,764,158 B2 · System and methods of defense against DDoS attacks for applications on a multi-substrate multi-ingress shared infrastructure > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,158 B2 - Document ID: US12764158B2 - Status: Granted - Kind: B2 - Application number: 18/759,047 - Filed: 2024-06-28 - Published: 2026-01-01 - Granted: 2026-10-13 - Earliest claimed: 2024-06-28 - Assignees: Salesforce, Inc. - Applicants: Salesforce, Inc. - Inventors: Kaushal Bansal; Prabhat Singh - Web page: https://patentgrep.com/patent/US12764158B2 ## CPC - H04L 63/1458: {Denial of Service} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer services environment may include web servers providing access domains and a network ingress paths receiving application-layer request messages. The application-layer request messages may each be received from a respective source via a respective ingress path and may be directed to a domain. The computing services environment may also include an orchestration engine configured to determine and implement mitigation policies corresponding with the ingress paths based on a classification of a subset of the plurality of application-layer request messages as being sent from a subset of the sources associated with a distributed denial of service attack. The mitigation policies may include rules to prevent a subset of subsequent application-layer request messages from the subset of the sources from reaching one or more components of the computing services environment. ## Claims ### Claim 1 A computing services environment providing computing services to a plurality of recipients via the Internet, the computing services environment comprising: a plurality of web servers providing access to a plurality of domains on behalf of the plurality of recipients; a plurality of network ingress paths receiving a plurality of application-layer request messages, each of the plurality of application-layer request messages being received from a respective source of a plurality of sources via a respective ingress path of the plurality of network ingress paths and being directed to a respective domain of the plurality of domains; an orchestration engine including one or more processors configured to: determine a probability that a spike in domain-specific network traffic corresponds to an application-layer distributed denial of service attack for a designated domain, and upon determining that the probability surpasses a designated threshold: classify individual sources among the plurality of sources based on application-layer characteristics of a subset of the plurality of application-layer request messages directed to the designated domain, the individual sources including a first source classified as associated with malicious behavior and a second source classified as potentially associated with the application-layer distributed denial of service attack, determine a plurality of domain-specific application-layer mitigation policies indicating for each of a plurality of source-domain-ingress path combinations whether to restrict subsequent communication from a respective source to the designated domain through a respective network ingress path, and generate, from the classifications of the individual sources and the determinations for the plurality of source-domain-ingress path combinations, the plurality of domain-specific application-layer mitigation policies including: (i) a blocked-source list identifying the first source and corresponding to a first rule configured to block subsequent application-layer request messages from the first source from reaching the designated domain via a first network ingress path, and (ii) an updated rate-limiting plan identifying the second source and corresponding to a second rule configured to throttle subsequent application-layer request messages from the second source to the designated domain via a second network ingress path; a generative language model interface configured to generate a report characterizing the application-layer distributed denial of service attack and the plurality of domain-specific application-layer mitigation policies, wherein the orchestration engine is further configured to identify a recipient of the plurality of recipients that is likely affected by the application-layer distributed denial of service attack and to transmit the report to the recipient; and one or more network controllers configured to implement one or more instructions characterizing the plurality of domain-specific application-layer mitigation policies received from the orchestration engine. ### Claim 2 (depends on 1) The computing services environment recited in claim 1, wherein the plurality of domain-specific application-layer mitigation policies are determined when a traffic level associated with a portion of the computing services environment exceeds a traffic threshold. ### Claim 3 (depends on 1) The computing services environment recited in claim 1, wherein the application-layer distributed denial of service attack is limited to a subset of the plurality of domains and a subset of the plurality of network ingress paths. ### Claim 4 (depends on 1) The computing services environment recited in claim 1, wherein the probability is determined based at least in part on historical network traffic data associated with one or more domains of the plurality of domains. ### Claim 5 A method implemented at an orchestration engine in a computing services environment providing computing services to a plurality of recipients via the Internet, the method comprising: identifying a plurality of application-layer request messages received at the computing services environment, each of the plurality of application-layer request messages being received from a respective source of a plurality of sources via a respective ingress path of a plurality of network ingress paths and being directed to a respective domain of a plurality of domains accessible via the computing services environment; determining a probability that a spike in domain-specific network traffic corresponds to an application-layer distributed denial of service attack for a designated domain; upon determining that the probability surpasses a designated threshold: classifying individual sources among the plurality of sources based on application-layer characteristics of a subset of the plurality of application-layer request messages directed to the designated domain, the individual sources including a first source classified as associated with malicious behavior and a second source classified as potentially associated with the application-layer distributed denial of service attack, determining via a processor a plurality of domain-specific mitigation policies indicating for each of a plurality of source-domain-ingress path combinations whether to restrict subsequent communication from a respective source to the designated domain through a respective network ingress path, generating, from the classifications of the individual sources and the determinations for the plurality of source-domain-ingress path combinations, the plurality of domain-specific application-layer mitigation policies including: (i) a blocked-source list identifying the first source and corresponding to a first rule configured to block subsequent application-layer request messages from the first source from reaching the designated domain via a first network ingress path, and (ii) an updated rate-limiting plan identifying the second source and corresponding to a second rule configured to throttle subsequent application-layer request messages from the second source to the designated domain via a second network ingress path, and generating a report characterizing the application-layer distributed denial of service attack and the plurality of domain-specific application-layer mitigation policies via a generative language model interface, wherein the orchestration engine is further configured to identify a recipient of the plurality of recipients that is likely affected by the application-layer distributed denial of service attack and to transmit the report to the recipient; and transmitting one or more instructions to implement the plurality of domain-specific application-layer mitigation policies to one or more controllers via a communication interface. ### Claim 6 (depends on 5) The method recited in claim 5, wherein the application-layer distributed denial of service attack is limited to a subset of the plurality of domains and a subset of the plurality of network ingress paths. ### Claim 7 (depends on 5) The method recited in claim 5, wherein the probability is determined based at least in part on historical network traffic data associated with one or more domains of the plurality of domains. ### Claim 8 One or more non-transitory computer readable media having instructions stored thereon for performing a method implemented at an orchestration engine in a computing services environment providing computing services to a plurality of recipients via the Internet, the method comprising: identifying a plurality of application-layer request messages received at the computing services environment, each of the plurality of application-layer request messages being received from a respective source of a plurality of sources via a respective ingress path of a plurality of network ingress paths and being directed to a respective domain of a plurality of domains accessible via the computing services environment; determining a probability that a spike in domain-specific network traffic corresponds to an application-layer distributed denial of service attack for a designated domain; upon determining that the probability surpasses a designated threshold: classifying individual sources among the plurality of sources based on application-layer characteristics of a subset of the plurality of application-layer request messages directed to the designated domain, the individual sources including a first source classified as associated with malicious behavior and a second source classified as potentially associated with the application-layer distributed denial of service attack, determining via a processor a plurality of domain-specific mitigation policies indicating for each of a plurality of source-domain-ingress path combinations whether to restrict subsequent communication from a respective source to the designated domain through a respective network ingress path, generating, from the classifications of the individual sources and the determinations for the plurality of source-domain-ingress path combinations, the plurality of domain-specific application-layer mitigation policies including: (i) a blocked-source list identifying the first source and corresponding to a first rule configured to block subsequent application-layer request messages from the first source from reaching the designated domain via a first network ingress path, and (ii) an updated rate-limiting plan identifying the second source and corresponding to a second rule configured to throttle subsequent application-layer request messages from the second source to the designated domain via a second network ingress path, and generating a report characterizing the application-layer distributed denial of service attack and the plurality of domain-specific application-layer mitigation policies via a generative language model interface, wherein the orchestration engine is further configured to identify a recipient of the plurality of recipients that is likely affected by the application-layer distributed denial of service attack and to transmit the report to the recipient; and transmitting one or more instructions to implement the plurality of domain-specific application-layer mitigation policies to one or more controllers via a communication interface. ### Claim 9 (depends on 8) The one or more non-transitory computer readable media recited in claim 8, wherein the application-layer distributed denial of service attack is limited to a subset of the plurality of domains and a subset of the plurality of network ingress paths. ### Claim 10 (depends on 8) The one or more non-transitory computer readable media recited in claim 8, wherein the probability is determined based at least in part on historical network traffic data associated with one or more domains of the plurality of domains.