Protecting a network site during adverse network conditions

• US 9,143,516 B1
• Filed: 03/30/2007
• Issued: 09/22/2015
• Est. Priority Date: 03/27/2007
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Nordstrom, Paul G., Bodell, Colin, Woods, Craig A.
• Primary Examiner(s): CHANG, KENNETH W
• Application Number:
  US11/694,858
• Time in Patent Office: 3,098 Days
• Field of Search: 726/23
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

According to aspects of the disclosed subject matter, a network protection service for processing network traffic to assist a network site is presented. The network protection service is communicatively coupled to the network site over a network, and is configured to detect that the network site is experiencing adverse network conditions. Upon detecting that the network site is experiencing adverse network conditions, the network protection service causes that a portion of the network traffic intended for the network site is rerouted to the network protection service. The network protection service then forwards a portion of the network traffic rerouted to the network protection service to the network site.

Claims

1. A system comprising:

one or more memories;

one or more computing devices of a network protection service; and

one or more modules that are stored on the one or more memories and that, when executed by the one or more computing devices, cause the one or more computing devices to provide functionality of the network protection service for a plurality of clients, the providing of the functionality of the network protection service including;

establishing, based on one or more electronic communications sent over one or more computer networks that are received by the network protection service, a relationship with a network site as one of the plurality of clients of the network protection service, including using supplied information to determine an agreed-upon level of protective assistance for the network protection service to provide to the network site under specified conditions;

detecting that the network site is experiencing adverse network conditions that satisfy the specified conditions;

causing, based at least in part on the agreed-upon level of protective assistance, network traffic intended for the network site to be rerouted to the one or more computing devices of the network protection service instead of to the network site, and using the one or more computing devices to process at least additional network traffic intended for the network site that exceeds a determined level of network traffic; and

forwarding, to the network site from the network protection service, a portion of the rerouted network traffic.

2. The system of claim 1 wherein the causing of the network traffic intended for the network site to be rerouted to the one or more computing devices includes causing all network traffic intended for the network site to be rerouted to the one or more computing devices.

3. The system of claim 1 wherein the providing of the functionality of the network protection service includes, after the forwarding of the portion of the rerouted network traffic from the network protection service to the network site, receiving responses from the network site and forwarding the received responses over the one or more computer networks to a recipient.

4. The system of claim 3 wherein the providing of the functionality of the network protection service includes establishing a private communication channel between the network protection service and the network site, and wherein the forwarding of the portion of the network traffic and the receiving of the responses are performed via the private communication channel.

5. The system of claim 1 wherein the information supplied for the network site as part of the establishing of the relationship indicates a type of protective assistance that the network site specifies for the network protection service to provide to the network site and indicates the specified conditions for use in identifying when to activate that type of protective assistance, and wherein the established relationship includes a subscription by the network site to that type of protective assistance from the network protection service.

6. The system of claim 1 wherein the providing of the functionality of the network protection service includes detecting a second condition indicating a change with regard to the adverse network conditions that the network site is experiencing, and upon detecting the second condition, causing the network traffic intended for the network site to be routed to the network site.

7. The system of claim 1 wherein the causing of the network traffic intended for the network site to be routed to the one or more computing devices of the network protection service includes causing only the additional network traffic that exceeds the determined level of network traffic to be rerouted to the one or more computing devices.

8. The system of claim 1 wherein the providing of the functionality of the network protection service includes filtering the rerouted network traffic to exclude some of the rerouted network traffic from further processing, and wherein the forwarding to the network site of the portion of the rerouted network traffic includes forwarding the filtered rerouted network traffic.

9. The system of claim 8 wherein the filtering of the rerouted network traffic includes reducing the filtered rerouted network traffic to the determined level of network traffic, and wherein the determined level of network traffic is indicated in the information supplied for the network site.

10. The system of claim 8 wherein the providing of the functionality of the network protection service includes determining the level of network traffic based on an amount of network traffic that the network site can process, and wherein the filtering of the rerouted network traffic includes selecting a volume of the rerouted network traffic based at least in part on the determined level of network traffic.

11. The system of claim 8 wherein the filtering of the rerouted network traffic includes excluding illegitimate network traffic from the further processing, and wherein the forwarding of the filtered rerouted network traffic includes forwarding only legitimate network traffic to the network site.

12. The system of claim 8 wherein the providing of the functionality of the network protection service includes establishing a set of rules for filtering the rerouted network traffic, and wherein the filtering of the rerouted network traffic is performed according to the set of rules.

13. The system of claim 12 wherein the set of rules includes a set of fuzzy logic statements for filtering network traffic.

14. The system of claim 12 wherein the set of rules includes a set of condition/action pairs for filtering network traffic.

15. The system of claim 8 wherein the filtering of the rerouted network traffic includes identifying network traffic that poses a risk to the network site and not forwarding the identified network traffic to the network site.

16. A computer-implemented method comprising:

establishing, by one or more computing systems of a network protection service having a plurality of clients, and based on one or more electronic communications sent over one or more computer networks to the one or more computing systems, a subscription relationship with a network site as one of the plurality of clients, wherein the establishing of the subscription relationship includes using information supplied for the network site to determine a level of protective assistance for the network protection service to provide to the network site, and wherein the information supplied for the network site specifies conditions under which the protective assistance of the network protection service is to be activated;

detecting, by the one or more computing systems, that the network site is experiencing adverse network conditions that satisfy the specified conditions under which the protective assistance of the network protection service is to be activated;

determining, by the one or more computing systems, an amount of network traffic that the network site can process and an amount of processing capacity needed to process additional network traffic intended for the network site;

providing, based at least in part on the level of protective assistance, one or more computing devices of the network protection service to provide the determined amount of processing capacity for processing the additional network traffic to the network site;

causing, by the one or more computing systems, at least the additional network traffic intended for the network site to be rerouted to the provided one or more computing devices of the network protection service instead of to the network site, and using the one or more computing devices to process the at least additional network traffic; and

forwarding, by the one or more computing systems and to the network site, a portion of the rerouted network traffic.

17. The method of claim 16 wherein the causing the at least additional network traffic to be rerouted includes causing all network traffic intended for the network site to be rerouted to the provided one or more computing devices of the network protection service.

18. The method of claim 16 further comprising, after the forwarding of the portion of the rerouted network traffic from the network protection service to the network site, receiving responses from the network site and forwarding the received responses over the one or more computer networks to one or more recipients.

19. The method of claim 18 further comprising establishing, by the one or more computing systems, a private communication channel with the network site, and wherein the forwarding of the portion of the rerouted network traffic and the receiving of the responses occurs via the private communication channel.

20. The method of claim 16 wherein the information supplied for the network site as part of the establishing of the subscription relationship further indicates a type of protective assistance specified by the network site for the network protection service to provide to the network site under the specified conditions, and wherein the established subscription relationship includes a subscription by the network site to that type of protective assistance from the network protection service.

21. The method of claim 16 further comprising detecting a change with regard to the adverse network conditions that the network site is experiencing, and causing the at least additional network traffic intended for the network site to be routed to the network site.

22. The method of claim 16 wherein the causing of the at least additional network traffic intended for the network site to be rerouted to the provided one or more computing devices of the network protection service includes causing only the additional network traffic that exceeds the determined amount of network traffic to be rerouted to the one or more computing devices.

23. The method of claim 16 further comprising filtering the rerouted network traffic to exclude some of the rerouted network traffic from further processing, and wherein the forwarding to the network site of the portion of the rerouted network traffic includes forwarding only the filtered rerouted network traffic.

24. The method of claim 23 wherein the filtering of the rerouted network traffic includes reducing the filtered rerouted network traffic to the determined amount of network traffic, and wherein the determined amount of network traffic is indicated in the information supplied for the network site.

25. The method of claim 23 wherein the filtering of the rerouted network traffic includes selecting a volume of the rerouted network traffic based at least in part on the determined amount of network traffic.

26. The method of claim 23 wherein the filtering of the rerouted network traffic includes distinguishing between legitimate and illegitimate network traffic and excluding the illegitimate network traffic from the further processing, and wherein the forwarding of the filtered rerouted network traffic includes forwarding only the legitimate network traffic to the network site.

27. The method of claim 23 further comprising establishing a set of condition/action pairs for filtering the rerouted network traffic, and wherein the filtering of the rerouted network traffic is performed according to the set of condition/action pairs.

28. The method of claim 27 wherein the filtering of the rerouted network traffic includes identifying network traffic that poses a risk to the network site and not forwarding the identified traffic to the network site.

29. The method of claim 28 wherein the identifying of the network traffic that poses a risk to the network site includes using a set of rules associated with the network site that are indicated in the information supplied for the network site.

30. The method of claim 29 wherein the set of rules associated with the network site includes a set of fuzzy logic directives for filtering network traffic.

31. The method of claim 29 wherein the set of rules associated with the network site includes a set of condition/action pairs for filtering network traffic.

32. A non-transitory computer-readable medium containing computer-executable instructions that when executed configure at least one computing device of an online network protection service to at least:

establish, by the at least one configured computing device of the online network protection service, and based on one or more electronic communications sent over one or more computer networks to the at least one configured computing device, a relationship with a network site as one of a plurality of clients of the online network protection service, wherein the establishing of the relationship includes using information supplied for the network site to determine an agreed-upon level of protective assistance for the online network protection service to provide to the network site under specified conditions;

detect, by the at least one configured computing device, that the network site is experiencing adverse network conditions that satisfy the specified conditions;

provide, based at least in part on the agreed-upon level of protective assistance, one or more computing devices of the online network protection service to provide processing capacity for processing network traffic intended for the network site;

cause, based at least in part on the agreed-upon level of protective assistance, at least a portion of network traffic intended for the network site to be rerouted to the one or more computing devices of the online network protection service instead of to the network site; and

forward, to the network site from the online network protection service, a subset of the rerouted network traffic.

33. The non-transitory computer-readable medium of claim 32 wherein the causing at least a portion of network traffic intended for the network site to be rerouted includes causing all network traffic intended for the network site to be rerouted to the network protection service.

34. The non-transitory computer-readable medium of claim 32 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to, after the forwarding of the subset of the rerouted network traffic from the online network protection service to the network site, receive responses from the network site, and forward the received responses over the one or more computer networks to one or more recipients.

35. The non-transitory computer-readable medium of claim 34 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to establish a private communication channel with the network site, and wherein the forwarding of the subset of the rerouted network traffic and the receiving of the responses occur via the private communication channel.

36. The non-transitory computer-readable medium of claim 32 wherein the information supplied for the network site as part of the establishing of the relationship further indicates a type of protective assistance specified by the network site for the online network protection service to provide to the network site and indicates the specified conditions for use in identifying when to activate that type of protective assistance, and wherein the established relationship includes a subscription by the network site to that type of protective assistance from the online network protection service.

37. The non-transitory computer-readable medium of claim 32 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to detect a change with regard to the adverse network conditions that the network site is experiencing, and to cause the at least portion of the network traffic intended for the network site to be routed to the network site.

38. The non-transitory computer-readable medium of claim 37 wherein the causing of the at least portion of the network traffic to be routed to the network site includes causing only a determined level of network traffic that the network site can process to be routed to the network site.

39. The non-transitory computer-readable medium of claim 32 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to filter the rerouted network traffic to exclude some of the rerouted network traffic from further processing, and wherein the forwarding to the network site of the subset of the rerouted network traffic includes forwarding only the filtered rerouted network traffic.

40. The non-transitory computer-readable medium of claim 39 wherein the filtering of the rerouted network traffic includes reducing the filtered rerouted network traffic to a determined amount of network traffic indicated in the information supplied for the network site.

41. The non-transitory computer-readable medium of claim 39 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to determine an amount of network traffic that the network site can process, and wherein the filtering of the rerouted network traffic includes selecting a volume of the rerouted network traffic based at least in part on the determined amount of network traffic.

42. The non-transitory computer-readable medium of claim 39 wherein the filtering of the rerouted network traffic includes distinguishing between legitimate and illegitimate network traffic, and wherein the forwarding of the filtered rerouted network traffic includes forwarding only the legitimate network traffic to the network site.

43. The non-transitory computer-readable medium of claim 39 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to establish a set of condition/action pairs for filtering the rerouted network traffic, and wherein the filtering of the rerouted network traffic is performed based on the set of condition/action pairs.

44. The non-transitory computer-readable medium of claim 43 wherein the filtering of the rerouted network traffic includes identifying network traffic that poses a risk to the network site and not forwarding the identified traffic to the network site.

45. The non-transitory computer-readable medium of claim 44 wherein the identifying of the network traffic that poses a risk to the network site includes identifying network traffic that poses a risk to the network site according to a set of rules associated with the network site.

46. The non-transitory computer-readable medium of claim 45 wherein the set of rules associated with the network site includes a set of fuzzy logic directives for filtering network traffic.

47. The non-transitory computer-readable medium of claim 45 wherein the set of rules associated with the network site includes a set of condition/action pairs for filtering network traffic.