PROTECTING NETWORKS FROM CYBER ATTACKS AND OVERLOADING

• US 20140283030A1
• Filed: 03/15/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Centripetal Networks, Inc.
• Original Assignee: Centripetal Networks, Inc.
• Inventors: Moore, Sean, Rogers, Steven, Scoggins, John Daniel Sr.
• Granted Patent: US 9,094,445 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Packets may be received by a packet security gateway. Responsive to a determination that an overload condition has occurred in one or more networks associated with the packet security gateway, a first group of packet filtering rules may be applied to at least some of the packets. Applying the first group of packet filtering rules may include allowing at least a first portion of the packets to continue toward their respective destinations. Responsive to a determination that the overload condition has been mitigated, a second group of packet filtering rules may be applied to at least some of the packets. Applying the second group of packet filtering rules may include allowing at least a second portion of the packets to continue toward their respective destinations.

Claims

1. A method, comprising:

at a computing platform comprising at least one processor, memory, and communication interface;

receiving, via the communication interface, a plurality of packets;

responsive to a determination that an overload condition has occurred in one or more networks associated with the computing platform, applying, by the processor and to at least some of the plurality of packets, a first group of packet filtering rules that comprises at least one five-tuple indicating a first set of packets that should be allowed to continue toward their respective destinations, wherein applying the first group of packet filtering rules includes allowing at least a first portion of the plurality of packets that fall within the first set of packets to continue toward their respective destinations; and

responsive to a determination that the overload condition has been mitigated to a first degree, applying, to at least some of the plurality of packets, a second group of packet filtering rules that comprises at least one five-tuple indicating a second set of packets that should be allowed to continue toward their respective destinations, wherein applying the second group of packet filtering rules includes allowing at least a second portion of the plurality of packets that fall within the second set of packets to continue toward their respective destinations, and wherein the second set of packets includes more packets than the first set of packets.

2. The method of claim 1, comprising:

responsive to a determination that the overload condition has been mitigated to a second degree, applying, to at least some of the plurality of packets, a third group of packet filtering rules that comprises at least one five-tuple indicating a third set of packets that should be allowed to continue toward their respective destinations, wherein applying the third group of packet filtering rules includes allowing at least a third portion of the plurality of packets that fall within the third set of packets to continue toward their respective destinations, wherein the third set of packets includes more packets than the second set of packets, and wherein the second degree is a greater degree of mitigation than the first degree.