US 12,341,807 B2
Packet fingerprinting for enhanced distributed denial of service protection
Jonathan R. Azaria, Beit Gamliel (IL); and Avishay Zawoznik, Tel-Aviv (IL)
Assigned to Imperva, Inc., San Mateo, CA (US)
Filed by Imperva, Inc., San Mateo, CA (US)
Filed on Dec. 17, 2019, as Appl. No. 16/718,059.
Prior Publication US 2021/0185083 A1, Jun. 17, 2021
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1458 (2013.01) [H04L 63/0236 (2013.01); H04L 63/1416 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method by one or more network devices implementing a scrubbing center for mitigating distributed denial of service attacks, wherein the scrubbing center is communicatively coupled to a plurality of clients and one or more servers, the method comprising:
determining a set of packet fingerprints seen in a set of packets sent between the plurality of clients and the one or more servers;
assigning a risk value to each packet fingerprint in the set of packet fingerprints based on analyzing historical information regarding previous security decisions made for packets having that packet fingerprint, wherein the previous security decisions were made by one or more security mechanisms separate from the scrubbing center that identify malicious traffic based on analyzing traffic seen by the one or more security mechanisms;
determining a historical traffic volume distribution of the set of packet fingerprints over a period of time that is longer than a most recent period of time, wherein the historical traffic volume distribution indicates a distribution of traffic volume across the set of packet fingerprints over the period of time;
detecting an occurrence of a potential distributed denial of service attack based on comparing a current traffic volume distribution of the set of packet fingerprints over the most recent period of time to the historical traffic volume distribution of the set of packet fingerprints over the period of time;
responsive to detecting the occurrence of a potential distributed denial of service attack, activating a security measure for each of one or more packet fingerprints in the set of packet fingerprints based on the risk value assigned to that packet fingerprint; and
responsive to detecting the occurrence of the potential distributed denial of service attack, assigning a fixed quota to each of a second one or more packet fingerprints in the set of packet fingerprints based on the historical traffic volume distribution of the set of packet fingerprints and activating a security measure for a given packet fingerprint when a volume of traffic or packet count associated with the given packet fingerprint exceeds the fixed quota assigned to the given packet fingerprint.