US 2020/0007575 A1 · METHODS AND SYSTEMS FOR DEFENDING AN INFRASTRUCTURE AGAINST A DISTRIBUTED DENIAL OF SERVICE ATTACK

Abstract

Methods and systems for defending an infrastructure against a distributed denial of service (DDoS) attack use a software decoy installed in the infrastructure to deliberately attract a malware. An address or a domain name of a command and control (C&C) server is extracted from the malware. A client of the infrastructure uses the address or the domain name of the C&C server to connect to the C&C server. The client receives a command intended by the C&C server to cause the client to participate in the DDoS attack. The client forwards particulars of the DDoS attack to a cleaning component. The cleaning component discards incoming signals having one or more of the particulars of the DDoS attack. The address or domain name of the C&C server may be obfuscated in the malware, in which case reverse engineering is used to decipher the malware.

Claims14

Dependent claims

A method for defending an infrastructure against a distributed denial of service (DDoS) attack, comprising:

receiving, at a software decoy of the infrastructure, a malware intended to infect the software decoy;
receiving the malware from the software decoy at a command and control (C&C) data collector of the infrastructure;
extracting from the malware, by the C&C data collector, an address or a domain name of a C&C server;
sending, from the C&C data collector to a client of the infrastructure, the address or the domain name of the C&C server;
using, by the client, the address or the domain name of the C&C server to connect the client to the C&C server;
receiving, at the client, a command intended by the C&C server to cause the client to participate in the DDoS attack;
forwarding particulars of the DDoS attack from the client to a cleaning component of the infrastructure;
and
discarding, in the cleaning component, incoming signals having at least one of the particulars of the DDoS attack.

6 more elements

A system for defending an infrastructure against a distributed denial of service (DDoS) attack, comprising:

a cleaning component adapted to discard incoming signals having at least one particular of a DDoS attack;
a software decoy adapted to receive a malware intended to infect the software decoy;
and
a command and control (C&C) data collector adapted to:
receive the malware from the software decoy;
and
extract from the malware an address or a domain name of a C&C server;
characterized in that the system further comprises:
a client adapted to:
receive the address or the domain name of the C&C server from the C&C data collector;
use the address or the domain name of the C&C server to connect to the C&C server,
receive, a command intended by the C&C server to cause the client to participate in the DDoS attack, and
forward particulars of the DDoS attack to the cleaning component.

10 more elements

Dependencies are inferred from the claim text.

Methods and systems for defending an infrastructure against a distributed denial of service attack

Life of this patent

Methods and systems for defending an infrastructure against a distributed denial of service attack

Life of this patent

Abstract

Claims14