US 11,895,116 B2
Methods and devices for blocking, detecting, and/or preventing malicious traffic
Dilip H. Sanghavi, San Ramon, CA (US); and Rishi K. Mutnuru, San Jose, CA (US)
Assigned to Juniper Networks, Inc., Sunnyvale, CA (US)
Filed by Juniper Networks, Inc., Sunnyvale, CA (US)
Filed on Jan. 13, 2021, as Appl. No. 17/248,182.
Application 17/248,182 is a continuation of application No. 16/025,541, filed on Jul. 2, 2018, granted, now 10,911,460.
Prior Publication US 2021/0136075 A1, May 6, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 45/748 (2022.01); H04L 61/256 (2022.01); H04L 67/02 (2022.01); H04L 61/4511 (2022.01)
CPC H04L 63/101 (2013.01) [H04L 45/748 (2013.01); H04L 61/256 (2013.01); H04L 61/4511 (2022.05); H04L 67/02 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
storing, by a processor and in a data structure, network addresses of devices hosting a plurality of blacklisted domains and blacklisted domain identifiers corresponding to the plurality of blacklisted domains;
receiving, by the processor, traffic destined for a destination device associated with a destination network address;
determining, by the processor, that the destination network address corresponds to a network address of the network addresses stored in the data structure;
determining, by the processor and based on determining that the destination network address corresponds to the network address, that the network address corresponds to a blacklisted domain identifier of the blacklisted domain identifiers and that a threat level associated with the blacklisted domain identifier satisfies a threshold;
selecting, by the processor, a sinkhole server identifier from a plurality of sinkhole server identifiers associated with the blacklisted domain identifier based on the threat level,
wherein the sinkhole server identifier is selected based on:
geographic proximity to a location of a client device, or
a round-robin scheduling process; and
redirecting, by the processor, the traffic towards a sinkhole server associated with the sinkhole server identifier.