Techniques for targeted botnet protection
AssigneeImperva, Inc.
InventorsNitzan NIV, Amichai SHULMAN
Life of this patent
Estimating the term…
Abstract
A botnet identification module identifies members of one or more botnets based upon network traffic destined to one or more servers over time, and provides sets of botnet sources to a traffic monitoring module. Each set of botnet sources includes a plurality of source identifiers of end stations acting as part of a corresponding botnet. A traffic monitoring module receives the sets of botnet sources from the botnet identification module, and upon a receipt of traffic identified as malicious that was sent by a source identified within one of the sets of botnet sources, activates a protection mechanism with regard to all traffic from all of the sources identified by the one of the sets of botnet sources for an amount of time.
Claims24
A method in a traffic monitoring module (TMM) that is implemented by an electronic device and that is for providing targeted botnet protection for one or more servers, wherein the TMM is deployed in front of the one or more servers in that the TMM receives all network traffic sent by a plurality of end stations that is destined for the one or more servers, the method comprising:
- receiving, at the TMM, a message including a plurality of identifiers that have been determined to be used by a subset of the plurality of end stations collectively acting as a suspected botnet, wherein each of the plurality of identifiers is or is based upon a network address;
- receiving, at the TMM from a first of the plurality of end stations, a request message that is destined for one of the one or more servers and that includes at least a first identifier of the plurality of identifiers;
- blocking, at the TMM, the request message from being sent to the one server responsive to a determination that the request message is malicious;
- and
- responsive to the determination and a different determination that the request message includes any of the plurality of identifiers in at least a set of one or more locations in the request message, activating, by the TMM for an amount of time, a protection mechanism that applies to all traffic that has any of the plurality of identifiers in any of the set of locations.
A non-transitory computer readable storage medium having instructions which, when executed by one or more processors of an electronic device, cause the electronic device to implement a traffic monitoring module (TMM) that is to perform operations for providing targeted botnet protection for one or more servers, wherein the TMM is to be deployed in front of the one or more servers in that the TMM receives all network traffic sent by a plurality of end stations that is destined for the one or more servers, the operations comprising:
- receiving a message including a plurality of identifiers that have been determined to be used by a subset of the plurality of end stations collectively acting as a suspected botnet, wherein each of the plurality of identifiers is or is based upon a network address;
- receiving, from a first of the plurality of end stations, a request message that is destined for one of the one or more servers and that includes at least a first identifier of the plurality of identifiers;
- blocking the request message from being sent to the one server responsive to a determination that the request message is malicious;
- and
- responsive to the determination and a different determination that the request message includes any of the plurality of identifiers in at least a set of one or more locations in the request message, activating, for an amount of time, a protection mechanism that applies to all traffic that has any of the plurality of identifiers in any of the set of locations.
Dependencies are inferred from the claim text.