Method and apparatus for distributed emulation of behavior of a malicious domain
AssigneeCloudflare, Inc.
InventorJustin Matthew PAINE
Life of this patent
Estimating the term…
Abstract
A method and apparatus that provide a malicious domain emulator in a distributed cloud computing network are described. A malicious node emulator is executed as a third-party code in a compute server of the cloud computing platform to enable emulation of behavior of a malicious node. The malicious node emulator receives requests from one or multiple network devices addressed to the malicious domain and automatically emulates the behavior of the malicious domain to respond to these requests. The malicious node emulator logs information related to the requests and the network devices transmitting the requests.
Claims27
A method in a distributed cloud computing platform comprising:
- receiving, at a first compute server of a plurality of compute servers, a first request from a client device, wherein the plurality of compute servers are part of the distributed cloud computing platform;
- and
- responsive to determining that the first request is destined to a malicious domain, wherein the malicious domain is registered with a proxy service of the distributed cloud computing platform causing requests for the malicious domain to be received to compute servers from the plurality of compute servers instead of a server that hosts the malicious domain, performing:
- executing, by a single process at the first compute server, a malicious node emulator, wherein the malicious node emulator is run in one of a plurality of isolated execution environments contained in the single process at the same time to emulate behavior of the server that hosts the malicious domain causing the first compute server to:
- transmit a first response to the client device, wherein the first response is consistent with an expected behavior of the server that hosts the malicious domain, and
- log information related to the first request received from the client device.
(canceled)
A non-transitory machine-readable storage medium of a first one of a plurality of compute servers that provides instructions that, when executed by a processor, cause the processor to perform operations comprising:
- receiving, at a first compute server of a plurality of compute servers, a first request from a client device, wherein the plurality of compute servers are part of a distributed cloud computing platform;
- and
- responsive to determining that the first request is destined to a malicious domain, wherein the malicious domain is registered with a proxy service of the distributed cloud computing platform causing requests for the malicious domain to be received to compute servers from the plurality of compute servers instead of a server that hosts the malicious domain, performing:
- executing, by a single process at the first compute server, a malicious node emulator, wherein the malicious node emulator is run in one of a plurality of isolated execution environments contained in the single process at the same time to emulate behavior of the server that hosts the malicious domain causing the first compute server to:
- transmit a first response to the client device, wherein the first response is consistent with an expected behavior of the server that hosts the malicious domain, and
- log information related to the first request received from the client device.
(canceled)
A first compute server comprising:
- a set of one or more processors;
- and
- a non-transitory machine-readable storage medium that provides instructions that, when executed by the set of processors, cause the set of processors to perform the following operations:
- receiving, at the first compute server of a plurality of compute servers, a first request from a client device, wherein the plurality of compute servers are part of a distributed cloud computing platform;
- and
- responsive to determining that the first request is destined to a malicious domain, wherein the malicious domain is registered with a proxy service of the distributed cloud computing platform causing requests for the malicious domain to be received to compute servers from the plurality of compute servers instead of a server that hosts the malicious domain, performing:
- executing, by a single process at the first compute server, a malicious node emulator, wherein the malicious node emulator is run in one of a plurality of isolated execution environments contained in the single process at the same time to emulate behavior of the server that hosts the malicious domain causing the first compute server to:
- transmit a first response to the client device, wherein the first response is consistent with an expected behavior of the server that hosts the malicious domain, and
- log information related to the first request received from the client device.
(canceled)
Dependencies are inferred from the claim text.