Defenses against software attacks in distributed computing environments

• US 7,620,986 B1
• Filed: 06/14/2005
• Issued: 11/17/2009
• Est. Priority Date: 06/14/2004
• Status: Active Grant

• Current Assignee: Virtual Instruments Worldwide, Inc.
• Original Assignee: Xangati Incorporated (Virtana Corp.)
• Inventors: Jagannathan, Jagan, Vasudevan, Rangaswamy
• Primary Examiner(s): Smithers; Matthew B
• Assistant Examiner(s): GERGISO, TECHANE
• Application Number:
  US11/153,217
• Time in Patent Office: 1,617 Days
• Field of Search: 726/22, 726/11, 713/150
• US Class Current: 726/22
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

The invention provides apparatus and methods for defending against attacks in a distributed computing environment, including (1) distinguishing attack traffic patterns from legitimate traffic patterns, (2) responsive to nature of message patterns; (3) attack traffic has few origination points, and does not divide further from target device; (4) detectors of illegitimate traffic can cooperate to confirm the suspected attack, with the effect of providing more information to each other.

Claims

1. A method, including steps of:

operating a first computing device coupled to a distributed computing environment;

maintaining a record of a first pattern of legitimate message traffic;

comparing a pattern of current message traffic received at the first computing device to said record of the first pattern of legitimate message traffic; and

taking action in response to said steps of comparing, including;

determining if the pattern of current message traffic includes attack traffic;

operating a second computing device coupled to said distributed computing environment and disposed to receive messages from said first computing device to ameliorate said attack traffic;

wherein the steps of taking action to ameliorate the attack traffic include steps of;

sending information regarding said pattern of current message traffic to a logically distinct location in a network;

comparing said information to a second pattern of message traffic at the logically distinct location; and

determining if the second pattern of message traffic at the logically distinct location includes attack traffic and ameliorating the attack traffic.

2. The method as in claim 1, wherein the pattern of legitimate messages includes a degree of resource usage based at least in part on response to a measure of time.

3. The method as in claim 1, wherein the pattern of legitimate messages includes a degree of resource usage based at least in part on response to a set of selected source addresses.

4. The method as in claim 1, wherein the pattern of legitimate messages includes a set of trusted source addresses.

5. The method as in claim 1, wherein the steps of taking action include steps of:

sending information regarding said current pattern of message traffic to a logically distinct location in a network; and

sharing said information among a plurality of such logically distinct locations.

6. The method as in claim 1, wherein the steps of taking action include steps of:

sharing information regarding the attack traffic among a plurality of logically distinct locations in a network; and

cooperating among the logically distinct locations to filter message traffic based at least in part on the shared information.

7. The method as in claim 6, including steps of, when the attack traffic originates from a location within a protected perimeter,

identifying messages associated with the attack traffic;

determining a message signature allowing other devices to identify messages associated with the attack traffic; and

sending the message signature to a filter at a logically distinct location.

8. The method as in claim 6, wherein the steps of cooperating define a protected perimeter about a target device.

9. The method as in claim 1, wherein the steps of taking action include steps of:

sharing information regarding the attack traffic among a plurality of logically distinct locations in a network; and

filtering message traffic at the logically distinct locations based at least in part on the shared information.

10. The method as in claim 9, including steps of, when that attack traffic originates from a location within a protected perimeter,

identifying messages associated with the attack traffic;

determining a message signature allowing other devices to identify messages associated with the attack traffic; and

sending the message signature to a filter at a logically distinct location.

11. The method as in claim 9, wherein the steps of cooperating define a protected perimeter about a target device.