Detecting triggering events for distributed denial of service attacks
AssigneeSophos Limited
InventorsKarl Ackerman, Mark David Harris, Simon Neil Reed, Andrew J. Thomas, Kenneth D. Ray
Life of this patent
Estimating the term…
Abstract
An endpoint in an enterprise network is monitored, and when a potential trigger for a distributed denial of service (DDoS) attack is followed by an increase in network traffic from the endpoint to a high reputation network address, the endpoint is treated as a DDoS service bot and isolated from the network until remediation can be performed.
Claims20
A computer program product for protecting against distributed denial of service attacks from an enterprise network, the computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
- detecting a potential trigger event on an endpoint in the enterprise network for a distributed denial of service attack;
- in response to detecting the potential trigger event, monitoring outbound traffic from the endpoint for an increase in network traffic from the endpoint directed to a high reputation network address over a predetermined time;
- in response to the potential trigger event followed by the increase in network traffic over the predetermined time, identifying the endpoint as having a compromised state in which the endpoint serves as a distributed denial of service bot for the distributed denial of service attack;
- and
- preventing all network traffic from the endpoint to the high reputation network address until the compromised state is remediated.
A method, comprising:
- monitoring outbound traffic from an endpoint in an enterprise network;
- detecting a potential trigger event for a distributed denial of service attack;
- in response to detecting the potential trigger event, monitoring the outbound traffic from the endpoint for an increase in network traffic from the endpoint directed to a high reputation network address over a predetermined time;
- in response to the potential trigger event followed by the increase in network traffic over the predetermined time, identifying the endpoint as having a compromised state wherein the endpoint serves as a distributed denial of service bot;
- and
- preventing all network traffic from the endpoint to the high reputation network address until the compromised state is remediated.
A threat management facility for managing an enterprise network, the threat management facility comprising:
- a network interface for coupling the threat management facility to the enterprise network;
- a memory;
- and
- a processor, the processor configured by computer executable code stored in the memory to protect against a distributed denial of service attack occurring within the enterprise network by performing the steps of monitoring outbound traffic from an endpoint in the enterprise network, detecting a potential trigger event on the enterprise network for a distributed denial of service attack, in response to detecting the potential trigger event, monitoring the outbound traffic from the endpoint for an increase in network traffic from the endpoint directed to a high reputation network address over a predetermined time, in response to the potential trigger event followed by the increase in network traffic over the predetermined time, identifying the endpoint as having a compromised state wherein the endpoint serves as a distributed denial of service bot, and preventing network traffic from the endpoint until the compromised state is remediated.
Dependencies are inferred from the claim text.