US 12,355,782 B1
Assessing coordinated malicious behavior towards a service provider network
Jared Sylvester, Ellicott City, MD (US); Michael Lowney, Arlington, VA (US); Catherine Watkins, Minneapolis, MN (US); Wayne Alan Fullen, Falls Church, VA (US); John Paul Schweitzer, Virginia Beach, VA (US); and Sameer Anil Murudkar, Sammamish, WA (US)
Assigned to Amazon Technologies, Inc., Seattle, WA (US)
Filed by Amazon Technologies, Inc., Seattle, WA (US)
Filed on Jun. 30, 2023, as Appl. No. 18/216,848.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/14 (2013.01) [H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
obtaining, by a graphing service of a security service of a service provider network, event archive bus (EBA) records related to unsuccessful requests from remote Internet protocol (IP) addresses attempting to access storage buckets of a storage service of the service provider network during a first time window;
grouping, by the graphing service, activity of the remote IP addresses by the first time window and remote IP address;
creating, by the graphing service, a first graph with a node for each remote IP address;
assigning, by the graphing service, a first node value to each node of the first graph, wherein each first node value is related to an approximate number of unsuccessful requests from a corresponding remote IP address during the first time window;
connecting, by the graphing service, related pairs of nodes in the first graph with edges;
assigning, by the graphing service, each edge connecting a pair of nodes a first edge weight;
multiplying, by the graphing service, all second node values and second edge weights of a second graph by a decay rate, wherein the second graph is based on a second time window prior in time to the first time window;
merging, by the graphing service, the first graph and the second graph into a third graph to provide third node values and third edge weights;
removing, by the graphing service, first nodes from the third graph that have third node values below a first predetermined threshold;
removing, by the graphing service, edges from the third graph that have third edge weight values below a second predetermined threshold;
removing, by the graphing service, second nodes from the third graph that have no edges connecting the first nodes to other nodes in the third graph;
determining, by the graphing service, a set of nodes in the third graph that have third node values that are equal to or above a third predetermined value; and
based on the set of nodes, performing, by the graphing service, an action with respect to corresponding IP addresses of the set of nodes.