Cyberattack prevention system
A self-updating system for defending against a cyberattack requests connected devices to solve a problem that is created in a random manner. The problems are created in a manner such that the system can determine whether the client device is being used as part of a cyberattack based on how the client device responds to the problems.
1. A system, comprising:
a non-transitory memory; and
one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
monitoring metrics associated with network communications;
determining a deviation of one or more of the metrics from a predetermined number;
in response to determining the deviation, updating a cyber defense system with a first predetermined update;
determining that the updating of the cyber defense system with the first predetermined update has caused an effect to the deviation; and
in response to determining that updating of the cyber defense system with the first predetermined update has caused the effect to the deviation, invalidating tokens for bypassing the cyber defense system that were provided by the cyber defense system before updating the cyber defense system with the first predetermined update.
2. The system of claim 1 , wherein the operations further comprise:
determining that the effect to the deviation is below a predetermined threshold; and
implementing a second predetermined update to the cyber defense system.
3. The system of claim 2 , wherein the second predetermined update is selected from a plurality of predetermined updates based at least in part on characteristics of the predetermined update.
4. The system of claim 2 , wherein determining that the effect to the deviation is below the predetermined threshold is based at least in part on a threshold deviation from the predetermined number.
5. The system of claim 2 , wherein the operations further comprise determining that a confidence threshold has not been passed by updating the cyber defense system with the first predetermined update.
6. The system of claim 5 , wherein implementing the second predetermined change is responsive to determining that the effect to the deviation is below the predetermined threshold and determining that the confidence threshold has not been passed.
7. A method, comprising:
monitoring, by one or more hardware processors, metrics associated with network communications;
determining, by the one or more hardware processors, a deviation of one or more of the metrics from a predetermined number;
in response to determining the deviation, updating, by the one or more hardware processors, a cyber defense system with a predetermined update;
determining, by the one or more hardware processors, that the updating of the cyber defense system with the predetermined update has caused an effect to the deviation; and
in response to determining that the updating of the cyber defense system with the predetermined update has caused the effect to the deviation, invalidating, by the one or more hardware processors, tokens for bypassing the cyber defense system that were provided by the cyber defense system before updating the cyber defense system with the predetermined update.
8. The method of claim 7 , further comprising:
determining that the effect to the deviation is below a predetermined threshold; and
implementing a second predetermined update to the cyber defense system.
9. The method of claim 8 , wherein the second predetermined update is selected from a plurality of predetermined updates based at least in part on characteristics of the first predetermined update.
10. The method of claim 8 , wherein determining that the effect to the deviation is below the predetermined threshold is based at least in part on a threshold deviation from the predetermined number.
11. The method of claim 8 , further comprising determining that a confidence threshold has not been passed by implementing updating the cyber defense system with the first predetermined update.
12. The method of claim 11 , wherein implementing the second predetermined change is responsive to determining that the effect to the deviation is below the predetermined threshold and determining that the confidence threshold has not been passed.
13. A non-transitory machine readable medium having stored thereon machine readable instructions executable to cause a machine to perform operations comprising:
monitoring metrics associated with network communications;
determining a deviation of one or more of the metrics from a predetermined number;
in response to determining the deviation of the one or more of the metrics from the predetermined number, updating a cyber defense system with a first predetermined update;
determining that the updating of the cyber defense system with the first predetermined update has caused an effect to the deviation; and
in response to determining that the updating of the cyber defense system with the first predetermined update has caused an effect to the deviation, invalidating tokens for bypassing the cyber defense system that were provided by the cyber defense system before updating the cyber defense system with the predetermined update.
14. The non-transitory machine readable medium of claim 13 , wherein the operations further comprise:
determining that the effect to the deviation is below a predetermined threshold; and
implementing a second predetermined update to the cyber defense system.
15. The non-transitory machine readable medium of claim 14 , wherein the second predetermined update is selected from a plurality of predetermined updates based at least in part on characteristics of the first predetermined update.
16. The non-transitory machine readable medium of claim 14 , wherein determining that the effect to the deviation is below the predetermined threshold is based at least in part on a threshold deviation from the predetermined number.
17. The non-transitory machine readable medium of claim 14 , wherein the operations further comprise determining that a confidence threshold has not been passed by updating the cyber defense system with the first predetermined update.