Defenses against software attacks in distributed computing environments
View Patent ↗The invention provides apparatus and methods for defending against attacks in a distributed computing environment, including (1) distinguishing attack traffic patterns from legitimate traffic patterns, (2) responsive to nature of message patterns; (3) attack traffic has few origination points, and does not divide further from target device; (4) detectors of illegitimate traffic can cooperate to confirm the suspected attack, with the effect of providing more information to each other.
1. A method, including steps of:
operating a first computing device coupled to a distributed computing environment;
maintaining a record of a first pattern of legitimate message traffic;
comparing a pattern of current message traffic received at the first computing device to said record of the first pattern of legitimate message traffic; and
taking action in response to said steps of comparing, including:
determining if the pattern of current message traffic includes attack traffic;
operating a second computing device coupled to said distributed computing environment and disposed to receive messages from said first computing device to ameliorate said attack traffic;
wherein the steps of taking action to ameliorate the attack traffic include steps of:
sending information regarding said pattern of current message traffic to a logically distinct location in a network;
comparing said information to a second pattern of message traffic at the logically distinct location; and
determining if the second pattern of message traffic at the logically distinct location includes attack traffic and ameliorating the attack traffic.
2. The method as in claim 1 , wherein the pattern of legitimate messages includes a degree of resource usage based at least in part on response to a measure of time.
3. The method as in claim 1 , wherein the pattern of legitimate messages includes a degree of resource usage based at least in part on response to a set of selected source addresses.
4. The method as in claim 1 , wherein the pattern of legitimate messages includes a set of trusted source addresses.
5. The method as in claim 1 , wherein the steps of taking action include steps of:
sending information regarding said current pattern of message traffic to a logically distinct location in a network; and
sharing said information among a plurality of such logically distinct locations.
6. The method as in claim 1 , wherein the steps of taking action include steps of:
sharing information regarding the attack traffic among a plurality of logically distinct locations in a network; and
cooperating among the logically distinct locations to filter message traffic based at least in part on the shared information.
7. The method as in claim 6 , including steps of, when the attack traffic originates from a location within a protected perimeter,
identifying messages associated with the attack traffic;
determining a message signature allowing other devices to identify messages associated with the attack traffic; and
sending the message signature to a filter at a logically distinct location.
8. The method as in claim 6 , wherein the steps of cooperating define a protected perimeter about a target device.
9. The method as in claim 1 , wherein the steps of taking action include steps of:
sharing information regarding the attack traffic among a plurality of logically distinct locations in a network; and
filtering message traffic at the logically distinct locations based at least in part on the shared information.
10. The method as in claim 9 , including steps of, when that attack traffic originates from a location within a protected perimeter,
identifying messages associated with the attack traffic;
determining a message signature allowing other devices to identify messages associated with the attack traffic; and
sending the message signature to a filter at a logically distinct location.
11. The method as in claim 9 , wherein the steps of cooperating define a protected perimeter about a target device.