Combining internet routing information with access logs to assess risk of user exposure
The present disclosure is directed towards systems and methods for evaluating or mitigating a network attack. A device determines one or more client internet protocol addresses associated with the attack on the service. The device assigns a severity score to the attack based on a type of the attack. The device identifies a probability of a user account accessing the service during an attack window based on the type of attack. The device generates an impact score for the user account based on the severity score and the probability of the user account accessing the service during the attack window. The device selects a mitigation policy for the user account based on the impact score.
1. A method of mitigating an attack on a service, comprising:
determining, by a device intermediary to a plurality of client devices and one or more servers configured to provide the service, one or more client internet protocol (IP) addresses associated with the attack on the service;
assigning, by the device, a severity score to the attack based on a type of the attack;
identifying, by the device, an attack window for the attack on the service, the attack window having a start time of the attack and an end time of the attack;
determining, by the device based on the type of the attack, the one or more client IP addresses, and a correlation between access logs for a user account and the attack window, a probability of the user account accessing the service during the attack window;
generating, by the device, an impact score for the user account, the impact score generated using both the severity score assigned to the attack based on the type of attack and the probability of the user account accessing the service during the attack window; and
selecting, by the device, a mitigation policy for the user account based on the impact score.
2. The method of claim 1 , comprising:
monitoring, by the device, an Internet routing table at one or more points in a network; and
detecting, by the device, the attack on the service based on a change in the Internet routing table that impacts a route for network traffic destined to the one or more servers.
3. The method of claim 1 , comprising:
monitoring, by the device, an authoritative Domain Name Registrar server; and
detecting, by the device, the attack based on a change of control of a domain name of the service maintained by the authoritative Domain Name Registrar server.
4. The method of claim 1 , comprising:
scanning, by the device, a communication port; and
detecting, by the device, the attack based on the scan indicating a rogue or forged certificate.
5. The method of claim 1 , comprising:
determining, by the device, the type of the attack as one of a Border Gateway Protocol attack, Domain Name System takeover attack, forged Secure Sockets Layer certificate attack, or rogue Secure Sockets Layer certificate attack.
6. The method of claim 1 , comprising:
determining, by the device, the type of the attack as one of a routing path change between infrastructure providers, a routing path change via an unregistered autonomous system, a routing path change having a new origin announced with a prefix greater than a predetermined length; and
classifying, by the device, a severity of the attack based on the type of the attack to assign the severity score, wherein a severity for the routing path change having the new origin announced with the prefix greater than the predetermined length is greater than a severity for the routing path change between infrastructure providers and a severity for the routing path change via the unregistered autonomous system.
7. The method of claim 1 , comprising:
performing, by the device, a lookup in a historical access log to identify the user account corresponding to network traffic originating from the one or more client IP addresses.
8. The method of claim 1 , comprising:
selecting, by the device, the mitigation policy comprising one of resetting a password of the user account, providing a security question for the user account, or restricting access to information of the user account for a predetermined time interval; and
activating, by the device, the selected mitigation policy for the user account.
9. The method of claim 1 , comprising:
identifying, by the device, a second user account associated with the attack;
identifying, by the device, a second probability of the second user account accessing the service during the attack window, the second probability less than the probability;
generating, by the device, a second impact score for the second user account, the second impact score less than the impact score; and
selecting, by the device, a second mitigation policy for the second user account based on the second impact score, the second mitigation policy different than the mitigation policy.
10. A system to mitigate an attack on a service, comprising:
a device intermediary to a plurality of client devices and one or more servers configured to provide the service;
a detection engine executed by the device configured to determine one or more client internet protocol (IP) addresses associated with the attack on the service;
a severity analyzer executed by the device configured to assign a severity score to the attack based on a type of the attack;
an impact assessor executed by the device configured to:
identify an attack window for the attack on the service, the attack window having a start time of the attack and an end time of the attack;
determine, based on the type of the attack, the one or more client IP addresses, and a correlation between access logs for a user account and the attack window, a probability of the user account accessing the service during the attack window; and
generate an impact score for the user account, the impact score generated using both the severity score assigned to the attack based on the type of attack and the probability of the user account accessing the service during the attack window; and
an impact mitigator executed by the device configured to select a mitigation policy for the user account based on the impact score.
11. The system of claim 10 , wherein the device is further configured to:
monitor an Internet routing table at one or more points in a network; and
detect the attack on the service based on a change in the Internet routing table that impacts a route for network traffic destined to the one or more servers.
12. The system of claim 10 , wherein the device is further configured to:
monitor an authoritative Domain Name Registrar server; and
detect the attack based on a change of control of a domain name of the service maintained by the authoritative Domain Name Registrar server.
13. The system of claim 10 , wherein the device is further configured to:
scan a communication port; and
detect the attack based on the scan indicating a rogue or forged certificate.
14. The system of claim 10 , wherein the device is further configured to:
determine the type of the attack as one of a Border Gateway Protocol attack, Domain Name System takeover attack, forged Secure Sockets Layer certificate attack, or rogue Secure Sockets Layer certificate attack.
15. The system of claim 10 , wherein the device is further configured to:
determine the type of the attack as one of a routing path change between infrastructure providers, a routing path change via an unregistered autonomous system, a routing path change having a new origin announced with a prefix greater than a predetermined length; and
classify a severity of the attack based on the type of the attack to assign the severity score, wherein a severity for the routing path change having the new origin announced with the prefix greater than the predetermined length is greater than a severity for the routing path change between infrastructure providers and a severity for the routing path change via the unregistered autonomous system.
16. The system of claim 10 , wherein the device is further configured to:
perform a lookup in a historical access log to identify the user account corresponding to network traffic originating from the one or more client IP addresses.
17. The system of claim 10 , wherein the device is further configured to:
select the mitigation policy comprising one of resetting a password of the user account, providing a security question for the user account, or restricting access to information of the user account for a predetermined time interval; and
activate the selected mitigation policy for the user account.
18. The system of claim 10 , wherein the device is further configured to:
identify a second user account associated with the attack;
identify a second probability of the second user account accessing the service during the attack window, the second probability less than the probability;
generate a second impact score for the second user account, the second impact score less than the impact score; and
select a second mitigation policy for the second user account based on the second impact score, the second mitigation policy different than the mitigation policy.