Techniques for targeted botnet protection using collective botnet analysis
AssigneeImperva, Inc.
InventorsNitzan NIV, Amichai SHULMAN
Life of this patent
Estimating the term…
Abstract
A botnet identification module identifies members of one or more botnets based upon network traffic destined to one or more servers over time, and provides sets of botnet sources to a traffic monitoring module. Each set of botnet sources includes a plurality of source identifiers of end stations acting as part of a corresponding botnet. A traffic monitoring module receives the sets of botnet sources from the botnet identification module, and upon a receipt of traffic identified as malicious that was sent by a source identified within one of the sets of botnet sources, activates a protection mechanism with regard to all traffic from all of the sources identified by the one of the sets of botnet sources for an amount of time.
Claims20
A method in a traffic monitoring module (TMM) that is implemented by an electronic device and that is for providing targeted botnet protection for one or more servers, wherein the TMM is deployed in front of the one or more servers in that the TMM receives all network traffic sent by a plurality of end stations that is destined for the one or more servers, the method comprising:
- receiving, at the TMM, a message including a plurality of identifiers that have been determined to be used by a subset of the plurality of end stations collectively acting as a suspected botnet, wherein each of the plurality of identifiers is or is based upon a network address;
- receiving, at the TMM from a plurality of end stations of the subset of end stations collective acting as the suspected botnet, a plurality of request messages that are destined for a set of one or more of the one or more servers, wherein each of the plurality of request messages includes at least one of the plurality of identifiers in at least a set of one or more locations in the request message;
- and
- responsive to a determination that the plurality of request messages each include, in the set of locations, an identifier that is within the plurality of identifiers and further that these plurality of request messages collectively satisfy a security rule, activating, by the TMM for an amount of time, a protection mechanism that applies to all traffic that has any of the plurality of identifiers in any of the set of locations, wherein none of the plurality of request messages individually would satisfy the security rule.
A non-transitory computer readable storage medium having instructions which, when executed by one or more processors of an electronic device, cause the electronic device to implement a traffic monitoring module (TMM) that is to perform operations for providing targeted botnet protection for one or more servers, wherein the TMM is to be deployed in front of the one or more servers in that the TMM receives all network traffic sent by a plurality of end stations that is destined for the one or more servers, the operations comprising:
- receiving a message including a plurality of identifiers that have been determined to be used by a subset of the plurality of end stations collectively acting as a suspected botnet, wherein each of the plurality of identifiers is or is based upon a network address;
- receiving, from a plurality of end stations of the subset of end stations collective acting as the suspected botnet, a plurality of request messages that are destined for a set of one or more of the one or more servers, wherein each of the plurality of request messages includes at least one of the plurality of identifiers in at least a set of one or more locations in the request message;
- and
- responsive to a determination that the plurality of request messages each include, in the set of locations, an identifier that is within the plurality of identifiers and further that these plurality of request messages collectively satisfy a security rule, activating, for an amount of time, a protection mechanism that applies to all traffic that has any of the plurality of identifiers in any of the set of locations, wherein none of the plurality of request messages individually would satisfy the security rule.
An electronic device to implement a traffic monitoring module (TMM) that is to perform operations for providing targeted botnet protection for one or more servers, wherein the TMM is to be deployed in front of the one or more servers in that the TMM receives all network traffic sent by a plurality of end stations that is destined for the one or more servers, the electronic device comprising:
- one or more processors;
- and
- a non-transitory computer readable storage medium having instructions which, when executed by the one or more processors, cause the electronic device to implement the TMM to:
- receive a message including a plurality of identifiers that have been determined to be used by a subset of the plurality of end stations collectively acting as a suspected botnet, wherein each of the plurality of identifiers is or is based upon a network address;
- receive, from a plurality of end stations of the subset of end stations collective acting as the suspected botnet, a plurality of request messages that are destined for a set of one or more of the one or more servers, wherein each of the plurality of request messages includes at least one of the plurality of identifiers in at least a set of one or more locations in the request message;
- and
- responsive to a determination that the plurality of request messages each include, in the set of locations, an identifier that is within the plurality of identifiers and further that these plurality of request messages collectively satisfy a security rule, activate, for an amount of time, a protection mechanism that applies to all traffic that has any of the plurality of identifiers in any of the set of locations, wherein none of the plurality of request messages individually would satisfy the security rule.
Dependencies are inferred from the claim text.