US 11,843,631 B2
Detecting triggering events for distributed denial of service attacks
Karl Ackerman, Topsfield, MA (US); Mark David Harris, Oxon (GB); Simon Neil Reed, Wokingham (GB); Andrew J. Thomas, Oxfordshire (GB); and Kenneth D. Ray, Seattle, WA (US)
Assigned to Sophos Limited, Abingdon (GB)
Filed by Sophos Limited, Abingdon (GB)
Filed on Jul. 8, 2021, as Appl. No. 17/370,895.
Application 17/370,895 is a continuation of application No. 15/479,476, filed on Apr. 5, 2017, granted, now 11,102,238.
Application 15/479,476 is a continuation of application No. PCT/US2016/040094, filed on Jun. 29, 2016.
Application PCT/US2016/040094 is a continuation in part of application No. 15/136,687, filed on Apr. 22, 2016, granted, now 11,277,416.
Application 15/136,687 is a continuation in part of application No. 15/136,762, filed on Apr. 22, 2016, granted, now 10,938,781, issued on Mar. 2, 2021.
Prior Publication US 2021/0344707 A1, Nov. 4, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/55 (2013.01); H04L 9/40 (2022.01); G06F 21/56 (2013.01); G06F 21/57 (2013.01)
CPC H04L 63/1458 (2013.01) [H04L 63/1416 (2013.01); H04L 63/1425 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer program product for protecting against distributed denial of service attacks from an enterprise network, the computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
detecting a potential trigger event on an endpoint in the enterprise network for a distributed denial of service attack;
in response to detecting the potential trigger event, monitoring outbound traffic from the endpoint for an increase in network traffic from the endpoint directed to a known, good reputation network address over a predetermined time;
in response to the potential trigger event followed by the increase in network traffic over the predetermined time, identifying the endpoint as having a compromised state in which the endpoint serves as a distributed denial of service bot for the distributed denial of service attack; and
preventing all network traffic from the endpoint to the known, good reputation network address until the compromised state is remediated.