Adjusting DDoS protection based on traffic type
View Patent ↗A system, method and computer readable storage medium that receives traffic/packets from external devices attempting to access protected devices in a protected network. A determination is made to whether a received packet belongs to one of a plurality of packet classifications. Each packet classification indicative of different classes of IP traffic. Countermeasures are applied to a received packet to prevent attack upon the protected devices. Applying a countermeasure to a received packet determined to belong to one of the plurality of packet classifications includes countermeasure modification/selection contingent upon the determined packet classification for the received packet.
1. A method performed by a computer system having one or more processors and memory storing one or more programs for execution by the one or more processors for handling requests to a protected network, comprising:
receiving packets from external devices attempting to access protected devices in the protected network;
determining if the received packets belong to one of a plurality of packet classifications with each packet classification indicative of different classes of IP traffic; and
selectively applying at least one of a first or second category of countermeasures to the received packets to prevent attack upon the protected devices, wherein countermeasures belonging to the first category are applied to the received packets on an individual basis and countermeasures belonging to the second category are applied to a stream of the received packets, wherein the first category comprises a plurality of raw countermeasures and the second category comprises a plurality of event driven countermeasures and wherein applying a countermeasure to a received packet or to a received stream of packets determined to belong to one of the plurality of packet classifications is contingent upon the determined packet classification for the received packet.
2. A method as recited in claim 1 , wherein a first category countermeasure includes blacklisting an IP address of a received packet contingent upon packet classification.
3. A method as recited in claim 1 , wherein the step of determining if a received packet belongs to one of a plurality of packet classifications includes analyzing the HTTP header of the packet to determine if an external device sending the packet is a proxy.
4. A method as recited in claim 3 , wherein a first category countermeasure excludes blacklisting if it is determined the external device of the received packet is a proxy.
5. A method as recited in claim 1 , wherein the step of determining if a received packet belongs to one of a plurality of packet classifications includes determining if an IP address associated with the received packet is associated with a web crawler.
6. A method as recited in claim 1 , wherein the step of determining if a received packet belongs to one of a plurality of packet classifications includes determining if an IP address associated with the received packet matches with IP addresses previously identified to be associated with malicious behavior.
7. A method as recited in claim 1 , wherein the method is running on a network protection device located between an external network and the protected network.
8. A method as recited in claim 1 , wherein the external devices are located within different external networks.
9. A system for handling requests to a protected network, comprising:
a memory;
a processor disposed in communication with said memory, and configured to issue a plurality of instructions stored in the memory, wherein the instructions issue signals to:
receive packets from external devices attempting to access protected devices in the protected network;
determine if the received packets belong to one of a plurality of packet classifications, each packet classification indicative of a certain threat level; and
selectively apply at least one of a first or second category of countermeasures to the received packets to prevent attack upon the protected devices, wherein countermeasures belonging to the first category are applied to the received packets on an individual basis and countermeasures belonging to the second category are applied to a stream of the received packets, wherein the first category comprises a plurality of raw countermeasures and the second category comprises a plurality of event driven countermeasures and wherein applying a countermeasure to a received packet or to a received stream of packets determined to belong to one of the plurality of packet classifications is contingent upon the determined packet classification for the received packet.
10. A system as recited in claim 9 , wherein a first category countermeasure includes blacklisting an IP address of a received packet contingent upon packet classification.
11. A system as recited in claim 9 , wherein the processor is further configured to issue signals to analyze the HTTP header of the packet to determine if an external device sending the packet is a proxy.
12. A system as recited in claim 11 , wherein a first category countermeasure excludes blacklisting if it is determined the external device sending the packet is a proxy.
13. A system as recited in claim 9 , wherein the processor is further configured to issue signals to determine if an IP address associated with the received packet is associated with a web crawler.
14. A system as recited in claim 9 , wherein the processor is further configured to issue signals to determine if an IP address associated with the received packet matches with an IP address previously identified to be associated with malicious behavior.
15. A non-transitory computer readable storage medium and one or more computer programs embedded therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:
receive packets from external devices attempting to access protected devices in the protected network;
determine if the received packets belong to one of a plurality of packet classifications, each packet classification indicative of different classes of IP traffic; and
selectively apply at least one of a first or second category of countermeasures to the received packets determined to belong to one of the plurality of packet classifications, wherein countermeasures belonging to the first category are applied to the received packets on an individual basis and countermeasures belonging to the second category are applied to a stream of the received packets, wherein the first category comprises a plurality of raw countermeasures and the second category comprises a plurality of event driven countermeasures and wherein the applied countermeasure is contingent upon the determined packet classification for the received packet.
16. A non-transitory computer readable storage medium as recited in claim 15 , wherein a first category countermeasure includes blacklisting an IP address of a received packet contingent upon packet classification.
17. A non-transitory computer readable storage medium as recited in claim 15 , wherein one or more of the computer programs cause the computer to issue signals to analyze the HTTP header of the packet to determine if an external device sending the packet is a proxy.
18. A non-transitory computer readable storage medium as recited in claim 17 , wherein a first category countermeasure excludes blacklisting if it is determined the external device sending the packet is a proxy.
19. A non-transitory computer readable storage medium as recited in claim 15 , wherein one or more of the computer programs cause the computer to determine if an IP address associated with the received packet is associated with a web crawler.
20. A non-transitory computer readable storage medium as recited in claim 15 , wherein one or more of the computer programs cause the computer to determine if an IP address associated with the received packet matches with an IP address previously identified to be associated with malicious behavior.