Internet security dynamics assessment system, program product, and related methods

A method of identifying and servicing real customer requests to a defended computer, the method comprising the steps of:

• receiving by the defended computer, a plurality of service requests from a corresponding plurality of IP addresses each associated with a separate one of a plurality of service requesting computers;
• blocking each service request by disconnecting communications between the defended computer and each of the plurality of service requesting computers;
• reestablishing communications with each of a plurality of service requesting computers by calling back the respective IP address of each separate one of the plurality of service requesting computers;
• sending an inspection code to each separate one of the plurality of service requesting computers at each respective associated IP address, the inspection code adapted to perform a virtual simulated attack on the respective service requesting computer;
• and
• restricting provision of services from the defended computer to a subset of the plurality of service requesting computers, each respective service requesting computer of the subset of the plurality of service requesting computers identified for restriction when a security feature of the respective service requesting computer is determined to have been defeated by the virtual simulated attack.

A method of identifying and servicing actual legitimate customer requests while simultaneously blocking communications with service requesting computers having nonexistent or spoofed IP addresses and service requesting computers associated with robot program service requests during a denial of service attack on a defended computer, the method comprising the steps of:

• determining an existence of a denial of service attack on the defended computer responsive to a denial of service identification scheme responsive to customer behavior profiling;
• blocking each of the plurality of IP addresses initially responsive to determining the existence of the denial of service attack;
• attempting to reestablish communications with each of the plurality of initially blocked IP addresses by calling the respective IP address back thereby establishing an existence or nonexistence of each of the plurality of initially blocked IP addresses;
• performing a virtual simulated attack separately directed to each of the plurality of initially blocked IP addresses responding to the call back to thereby identify a subset of the plurality of IP addresses each associated with a separate one of a plurality of substantially protected computers;
• sending a user response request to each IP address of the identified subset of the plurality of substantially protected service requesting computers to thereby identify a plurality of actual customer IP addresses associated with a corresponding plurality of the substantially protected actual customer service requesting computers;
• and
• resuming service to the plurality of actual customer IP addresses during the denial of service attack while simultaneously maintaining a block on each IP address associated with a not substantially protected computer and maintaining a block on each spoofed IP address.

Security and dynamic risk assessment and management program product stored in a non-transitory computer readable storage medium to provide dynamic risk assessment and management, the program product including instructions that when executed by a defended computer, cause the defended computer to perform the operations of:

• blocking IP addresses of each separate one of a plurality of communication requesting computers attempting to communicate with the defended computer during a denial of service type attack;
• initiating a virtual attack on each of the plurality of communication requesting computers to determine if the respective communication requesting computer can be compromised by a malicious software code associated with the virtual attack;
• sending a user response request to each of the plurality of communication requesting computers found to be invulnerable to each of one or more vulnerability schemes associated with the virtual attack to thereby determine if each respective invulnerable communication requesting computer has a “human-in-the-loop”;
• and
• allowing resumption of communications with each of a subset of the plurality of communication requesting computers found to be invulnerable to each of one or more vulnerability scheme associated with the virtual attack and that returned an affirmative response to the respective user response request.

Security and dynamic risk assessment and management program product stored in a non-transitory computer readable storage medium to provide dynamic risk assessment and management, the program product including instructions that when executed by a secondary network computer, cause the secondary network computer to perform the operations of:

• receiving, by the secondary network computer, one or more of the following:
• indicia that a network defended server is encountering a denial of service type attack, and instructions to initiate a virtual attack on a plurality of communication requesting computers associated with a set of a corresponding plurality of initially blocked IP addresses;
• attempting to communicate with each of the plurality of communication requesting computers associated with the set of the plurality of blocked IP addresses to eliminate nonexistent IP addresses from the set of initially blocked IP addresses, to thereby form a significantly reduced set of computer IP addresses to further analyze;
• sending a separate copy of an inspection code to each communication requesting computer associated with one of the reduced set of computer IP addresses, the inspection code adapted to perform the virtual attack on the respective associated communication requesting computer;
• receiving a notification from each respective inspection code indicating that the virtual attack successfully defeated a security feature of the respective attacked communication requesting computer defining a respective compromised communication requesting computer, or that the virtual attack failed to defeat each tested security feature of the respective attacked communication requesting computer defining a respective non-compromised communication requesting computer;
• sending a user response request to each non-compromised communication requesting computer;
• receiving either a confirmation of an original service request or a denial of any such service request, or timing out when no response to the respective user response request was received:
• and
• assembling one or more lists indicating one or more of the following:
• accepted IP addresses of attacked communication requesting computers found to be invulnerable to the virtual attack and which returned a human actuated confirmation of an original service request, and
• restricted IP addresses of attacked communication requesting computers that should remain blocked or restricted as being found to be actually vulnerable to at least one vulnerability scheme provided in the respective virtual attack or found to be an actual spoofed IP address providing a negative response or no response to the respective user response request provided thereto, the one or more lists being usable by the defended server to allow resumption of communication with each of the computers having an IP address on the accepted IP addresses list, while simultaneously restricting communications with each of the computers having an IP address on the restricted IP address list.