Mechanism for distributed rate limiting
AssigneeSymantec Corporation
InventorsMichael Shavell, Ilya Sokolov
Life of this patent
Estimating the term…
Abstract
A method for distributed rate limiting is provided. The method includes detecting, in a first communication received by an application, a suspicious behavior, the first communication having traveled through a network to the application, the detecting performed by a rate limiter coupled to the application. The method includes communicating, from a blocking analytics module associated with the application, to a blocker located in the network, information regarding an origin of the first communication. The method includes blocking, at the blocker located in the network, further communication having a same origin as the origin of the first communication.
Claims20
A method for distributed rate limiting, comprising:
- detecting, in a first communication received by an application, a suspicious behavior, the first communication having traveled through a network to the application, the detecting performed by a rate limiter coupled to the application;
- communicating, from a blocking analytics module associated with the application, to a blocker located in the network, information regarding an origin of the first communication;
- blocking, at the blocker located in the network, further communication having a same origin as the origin of the first communication;
- maintaining, in the blocker, a list of a plurality of origins of suspicious communications, which includes the origin of the first communication, based on information from a plurality of blocking analytics modules associated with a plurality of applications;
- and
- blocking, at the blocker located in the network, further communication having origins same as the plurality of origins of suspicious communications, wherein at least one action of the method is performed by a processor.
A tangible, non-transitory, computer-readable media having instructions thereupon which, when executed by a processor, cause the processor to perform a method comprising:
- coupling with a rate limiter of an application;
- coupling with a blocker in a network to which the application is coupled;
- cooperating with the rate limiter to determine an origin of a first communication received by the application via the network, responsive to a determination by the rate limiter that the first communication is suspicious;
- and
- sending to the blocker, via the network, information about the origin of the first communication, wherein the blocker maintains a list of a plurality of origins of suspicious communications, including the origin of the first communication, based on information from a plurality of blocking analytics modules associated with a plurality of applications and wherein the blocker cooperates with at least one component of the network to block further communication having a same origin as on the list of the plurality of origins of suspicious communications.
A distributed rate limiting system, comprising:
- a computing device, comprising hardware;
- a blocking analytics module in the computing device, configured to couple to a software-based rate limiter of an application and couple, via a network, to a blocker located in the network, the blocking analytics module further configured to send information regarding an origin of a first communication to the blocker, responsive to a determination made by the software-based rate limiter of suspicious behavior in the first communication;
- the blocker, configured to reside in a network component in the network and further configured to block at least a second communication having a same origin as the origin of the first communication, based on the information, regarding the origin of the first communication, as received from the blocking analytics module;
- the blocker having a communications module configured to communicate with a plurality of blocking analytics modules, each of the plurality of blocking analytics modules associated with a further application;
- and
- the blocker configured to maintain a list of origins of suspicious communications, based on information from the plurality of blocking analytics modules, and configured to block further communication having same origins as the origins of the suspicious communications.
Dependencies are inferred from the claim text.