US 8,613,089 B1 · Identifying a denial-of-service attack in a cloud-based proxy service

Abstract

A cloud-based proxy service identifies a denial-of-service (DoS) attack including determining that there is a potential DoS attack being directed to an IP address of the cloud-based proxy service; and responsive to determining that there are a plurality of domains that resolve to that IP address, identifying the one of the plurality of domains that is the target of the DoS attack. The domain that is under attack is identified by scattering the plurality of domains to resolve to different IP addresses, where a result of the scattering is that each of those domains resolves to a different IP address, and identifying one of those plurality of domains as the target of the DoS attack by determining that there is an abnormally high amount of traffic being directed to the IP address in which that domain resolves.

Claims24

Dependent claims

A method in a cloud-based proxy service for identifying a target of a denial-of-service (DoS) attack, the method comprising:

determining that there is an abnormal flow of traffic being directed to an IP address of the cloud-based proxy service that is indicative of the DoS attack;
responsive to determining that there are a plurality of domains that resolve to that IP address, identifying the one of the plurality of domains that is the target of the DoS attack, wherein the step of identifying includes performing the following:
scattering the plurality of domains to resolve to different IP addresses, wherein a result of the scattering is that each of those domains resolves to a different IP address, and
identifying one of those plurality of domains as the target of the DoS attack by determining that there is an abnormally high amount of traffic being directed to the IP address in which that domain resolves.

1 more element

A non-transitory computer-readable storage medium that provides instructions that, when executed by a processor of a proxy server, will cause said processor to perform operations comprising:

determining that there is an abnormal flow of traffic being directed to an IP address that is indicative of a Denial of Service (DoS) attack;
responsive to determining that there are a plurality of domains that resolve to that IP address, identifying the one of the plurality of domains that is a target of the DoS attack, wherein the step of identifying includes performing the following:
scattering the plurality of domains to resolve to different IP addresses, wherein a result of the scattering is that each of those domains resolves to a different IP address, and identifying one of those plurality of domains as the target of the DoS attack by determining that there is an abnormally high amount of traffic being directed to the IP address in which that domain resolves.

An apparatus to identify a target of a denial-of-service (DoS) attack in a cloud-based proxy service, comprising:

a cloud-based proxy service node that is configured to perform the following:
determine that there is an abnormal flow of traffic being directed to an IP address of the cloud-based proxy service that is indicative of the DoS attack;
responsive to a determination that there are a plurality of domains that resolve to that IP address, identify the one of the plurality of domains that is the target of the DoS attack by performing the following:
scatter the plurality of domains to resolve to different IP addresses, wherein a result of the scattering is that each of those domains resolves to a different IP address, and identify one of those plurality of domains as the target of the DoS attack by a determination that there is an abnormally high amount of traffic being directed to the IP address in which that domain resolves.

1 more element

Dependencies are inferred from the claim text.

Identifying a denial-of-service attack in a cloud-based proxy service

Life of this patent

Identifying a denial-of-service attack in a cloud-based proxy service

Life of this patent

Abstract

Claims24