# US 2018/0026994 A1 · Network attack defense system and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0026994 A1 - Document ID: US20180026994A1 - Status: Published application - Kind: A1 - Application number: 15/653,157 - Filed: 2017-07-18 - Published: 2018-01-25 - Earliest claimed: 2016-07-22 - Assignees: Alibaba Group Holding Limited - Applicants: Alibaba Group Holding Limited - Inventors: Xiao Han; Shuning Ge - Web page: https://patentgrep.com/patent/US20180026994A1 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Network attack defense includes: obtaining a set of one or more statistical attributes for a protected site by gathering statistics for a set of one or more site attributes of the protected site, the site attributes indicating an operation mode of the protected site; determining, based on the set of one or more statistical attributes, that the protected site is to transition from a current operation mode to a target operation mode, wherein the current operation mode has a current defense strategy different from a target defense strategy of the target operation mode; and if the protected site is to transition from the current operation mode to the target operation mode, transitioning from the current operation mode to the target operation mode and applying the target defense strategy for the protected site instead of the current operation mode. ## Claims ### Claim 1 A network attack defense method comprising: obtaining a set of one or more statistical attributes for a protected site by gathering statistics for a set of one or more site attributes of the protected site, the set of one or more site attributes of the protected site indicating an operation mode of the protected site; determining, based at least in part on the set of one or more statistical attributes, that the protected site is to transition from a current operation mode to a target operation mode, wherein the current operation mode has a current defense strategy and the target operation mode has a target defense strategy, and wherein the current defense strategy differs from the target defense strategy; and in response to the determination that the protected site is to transition from the current operation mode to the target operation mode, transitioning from the current operation mode to the target operation mode and applying the target defense strategy for the protected site. ### Claim 2 (depends on 1) The method of claim 1, wherein the obtaining of the statistical attributes for the protected site comprises: obtaining a plurality of HTTP packets received by the protected site within a specified time interval; and extracting site attributes from the HTTP packets to gather statistics for site attributes of a same type of HTTP headers to obtain the statistical attributes. ### Claim 3 (depends on 2) The method of claim 2, wherein the obtaining of the plurality of HTTP packets comprises: obtaining a set of HTTP packets from a plurality of data sources; and categorizing the set of HTTP packets based on their respective destination sites to determine the plurality of HTTP packets for the protected site. ### Claim 4 (depends on 1) The method of claim 1, wherein the determining of the protected site is to transition from the current operation mode to the target operation mode comprises: obtaining rolling averages for the statistical attributes; obtaining a time duration during which the protected site has been in the current operation mode; and determining whether the protected site is to transition from the current operation mode to the target operation mode, the determination being based at least in part on: the statistical attributes, the rolling averages for the statistical attributes, and the time duration. ### Claim 5 (depends on 1) The method of claim 1, wherein the determining of the protected site is to transition from the current operation mode to the target operation mode comprises: inputting rolling averages, the statistical attributes, and a time duration during which the protected site has been in the current operation mode into a Boolean function corresponding to the protected site to generate an output value; and determining, by using the output value, that the protected site is to transition from the current operation mode to the target operation mode. ### Claim 6 (depends on 1) The method of claim 1, wherein the current defense strategy comprises a plurality of defense algorithms, wherein a defense algorithm in the plurality of defense algorithms has a corresponding plurality of defense levels, and wherein the corresponding plurality of defense levels indicates extents to which the protected site is protected. ### Claim 7 (depends on 6) The method of claim 6, wherein the set of one or more statistical attributes for the protected site indicates an operation mode of the protected site within a first pre-determined time interval; and wherein the method further comprises: gathering statistics to obtain a false positive rate for the protected site during a second pre-determined time interval, wherein the protected site is deployed with the current defense strategy; and adjusting the current defense strategy when the false positive rate exceeds a corresponding threshold value. ### Claim 8 (depends on 7) The method of claim 7, wherein the adjusting of the current defense strategy includes adjusting a corresponding defense algorithm, adjusting a corresponding defense level, or both. ### Claim 9 (depends on 1) The method of claim 1, wherein the set of one or more statistical attributes for the protected site indicates an operation mode of the protected site within a specified time interval. ### Claim 10 A system, comprising: one or more processors configured to: obtain a set of one or more statistical attributes for a protected site by gathering statistics for a set of one or more site attributes of the protected site, the set of one or more site attributes indicating an operation mode of the protected site; determine, based on the set of one or more statistical attributes, that the protected site is to transition from a current operation mode to a target operation mode, wherein the current operation mode has a current defense strategy and the target operation mode has a target defense strategy, and wherein the current defense strategy differs from the target defense strategy; and in response to the determination that the protected site is to transition from the current operation mode to the target operation mode, transition from the current operation mode to the target operation mode and apply the target defense strategy for the protected site instead of the current operation mode; and one or more memories coupled to the one or more processors and configured to provide the one or more processors with instructions. ### Claim 11 (depends on 10) The system of claim 10, wherein to obtain the set of one or more statistical attributes for the protected site comprises to: obtain a plurality of HTTP packets received by the protected site within a specified time interval; and extract site attributes from the plurality of HTTP packets to gather statistics for site attributes of a same type of HTTP headers to obtain the statistical attributes. ### Claim 12 (depends on 11) The system of claim 11, wherein to obtain the plurality of HTTP packets comprises to: obtain a set of HTTP packets from a plurality of data sources; and categorize the set of HTTP packets based on destination sites to determine the plurality of HTTP packets for the protected site. ### Claim 13 (depends on 10) The system of claim 10, wherein to determine that the protected site is to transition from the current operation mode to the target operation mode comprises to: obtain rolling averages for the statistical attributes; obtain a time duration during which the protected site has been in the current operation mode; and determine whether the protected site is to transition from the current operation mode to the target operation mode, the determination being based at least in part on: the statistical attributes, the rolling averages for the statistical attributes, and the time duration. ### Claim 14 (depends on 10) The system of claim 10, wherein to determine that the protected site is to transition from the current operation mode to the target operation mode comprises to: input rolling averages, the statistical attributes, and a time duration during which the protected site has been in the current operation mode into a Boolean function corresponding to the protected site to generate an output value; and determine, by using the output value, that the protected site is to transition from the current operation mode to the target operation mode. ### Claim 15 (depends on 10) The system of claim 10, wherein the current defense strategy comprises a plurality of defense algorithms, wherein a defense algorithm in the plurality of defense algorithms has a corresponding plurality of defense levels, and wherein the corresponding plurality of defense levels indicates extents to which the protected site is protected. ### Claim 16 (depends on 15) The system of claim 15, wherein the set of one or more statistical attributes for the protected site indicates an operation mode of the protected site within a first pre-determined time interval; and wherein the one or more processors are further configured to: gather statistics to obtain a false positive rate for the protected site during a second pre-determined time interval, wherein the protected site is deployed with the current defense strategy; and adjust the current defense strategy when the false positive rate exceeds a corresponding threshold value. ### Claim 17 (depends on 16) The system of claim 16, wherein to adjust the current defense strategy includes to adjust a corresponding defense algorithm, adjust a corresponding defense level, or both. ### Claim 18 (depends on 11) The System of claim 11, wherein the set of one or more statistical attributes for the protected site indicates an operation mode of the protected site within a specified time interval. ### Claim 19 A computer program product for network attack defense, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for: obtaining a set of one or more statistical attributes for a protected site by gathering statistics for a set of one or more site attributes of the protected site, the set of one or more site attributes indicating an operation mode of the protected site; determining, based on the set of one or more statistical attributes, that the protected site is to transition from a current operation mode to a target operation mode, wherein the current operation mode has a current defense strategy and the target operation mode has a target defense strategy, and wherein the current defense strategy differs from the target defense strategy; and in response to the determination that the protected site is to transition from the current operation mode to the target operation mode, transitioning from the current operation mode to the target operation mode and applying the target defense strategy for the protected site instead of the current operation mode.