US 12,341,805 B1
Mitigation of malware code-distribution sites
Kelly Anne Rooker, Seattle, WA (US); Lewis Iain McLean, Seattle, WA (US); Andrew Robert Hassall, Seattle, WA (US); Grace Marie Hatamyar, Seattle, WA (US); Thomas Bradley Scholl, Seattle, WA (US); Kushal Mall, Seattle, WA (US); Darshan Reddy, Seattle, WA (US); Bradford Sachin Chatterjee, Seattle, WA (US); Bobby Brown, Seattle, WA (US); Sidath Manawadu, Seattle, WA (US); Karthik Chandrashekar, Seattle, WA (US); John Shields, Seattle, WA (US); Thomas William Bray, Seattle, WA (US); and Benjamin Patrick Albertson-Gass, Seattle, WA (US)
Assigned to Amazon Technologies, Inc., Seattle, WA (US)
Filed by Amazon Technologies, Inc., Seattle, WA (US)
Filed on Jun. 6, 2022, as Appl. No. 17/833,680.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/145 (2013.01) [H04L 63/1416 (2013.01); H04L 63/1458 (2013.01)] 22 Claims
OG exemplary drawing
 
1. A system for managing network-based services, the system comprising one or more external computing devices associated with a processor and a memory for executing computer-executable instructions to implement a monitoring and mitigation service, wherein the monitoring and mitigation service is configured to:
monitor a set of network devices, wherein the set of network devices includes a subset of network devices configured solely for monitoring purposes;
detect an initial code sent from an external computing device to the subset of network devices configured solely for monitoring purposes;
install the initial code into one or more of the subset of network devices, wherein installing the initial code causes the one or more of the subset of network devices to transmit a request to install a second code to the external computing device;
scan the subset of network devices configured solely for monitoring purposes to detect characteristics of the request to install the second code, wherein the characteristics of the request to install the second code include at least an internet protocol (IP) address of the external computing device;
identify, using the identified IP address of the external computing device, a network mitigation information in a form of null routing addresses, wherein the network mitigation information is associated with an expiration criteria;
cause an implementation of the network mitigation information in one or more routing components associated with network devices such that communications with the external computing device are mitigated;
determine that the network mitigation information has expired; and
cause at least one renewal of the network mitigation information or withdrawal of the network mitigation information based on the determined expiration.