Detecting adverse network conditions for a third-party network site

• US 9,148,437 B1
• Filed: 03/30/2007
• Issued: 09/29/2015
• Est. Priority Date: 03/27/2007
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Nordstrom, Paul G., Bodell, Colin, Woods, Craig A.
• Primary Examiner(s): Chang, Kenneth
• Application Number:
  US11/694,814
• Time in Patent Office: 3,105 Days
• Field of Search: 726/13
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A network protection service for providing protective assistance to a subscribing host is presented. The network protection service is configured determine a set of rules for filtering network traffic for a subscribing host. The network protection service is further configured to receive network traffic on behalf of the subscribing host, filter the received network traffic according to the set of rules, and forward a portion of the filtered network traffic to the subscribing host. Still further, the network protection service is configured to analyze the received network traffic via the analysis server, and refine the set of rules for filtering the received network traffic based on the analysis of the received network traffic by the analysis server.

Claims

1. A system comprising:

one or more memories;

one or more computing devices of an online network protection service; and

one or more modules that are stored on the one or more memories and that, when executed by the one or more computing devices, cause the one or more computing devices to provide functionality of the online network protection service to assist a plurality of clients of the online network protection service, the providing of the functionality of the online network protection service including;

establishing, based on one or more electronic communications sent over one or more computer networks to the online network protection service, a relationship with a subscribing host system as one of the plurality of clients of the online network protection service, including using supplied information for the subscribing host system to determine an agreed-upon level of protective assistance for the online network protection service to provide to the subscribing host system under specified conditions;

determining, for the subscribing host system and based at least in part on the supplied information, a set of rules for filtering network traffic directed to the subscribing host system;

causing, based at least in part on a determination that the specified conditions are satisfied, a subset of the network traffic directed to the subscribing host system to be rerouted to the one or more computing devices of the online network protection service instead of to the subscribing host system;

filtering, by the one or more computing devices of the online network protection service and based at least in part on the agreed-upon level of protective assistance, the rerouted network traffic according to the set of rules;

forwarding, by the one or more computing devices of the online network protection service, a portion of the filtered network traffic to the subscribing host system;

analyzing the rerouted network traffic; and

refining the set of rules for filtering network traffic based on the analyzing of the rerouted network traffic.

2. The system of claim 1 wherein information supplied for the subscribing host system as part of the establishing of the relationship indicates a type of protective assistance specified by the subscribing host system for the online network protection service to provide to the subscribing host system and indicates the specified conditions for use in identifying when to activate that type of protective assistance, and wherein the established relationship includes a subscription by the subscribing host system to that type of protective assistance from the online network protection service.

3. The system of claim 1, further comprising a data store configured to store the set of rules for the subscribing hosts system and to store other sets of rules for other clients of the online network protection service.

4. The system of claim 1 wherein the set of rules for filtering network traffic includes a set of condition/action pairs such that upon detection of a condition of a rule a corresponding action is taken.

5. The system of claim 4 wherein the set of condition/action pairs includes nested condition/action pairs.

6. The system of claim 1 wherein the set of rules for filtering network traffic includes a set of fuzzy logic statements for filtering network traffic.

7. The system of claim 1 wherein the providing of the functionality of the online network protection service includes determining a current capacity of the subscribing host system for processing network traffic, and wherein the filtering of the rerouted network traffic according to the set of rules further includes filtering the rerouted network traffic to be within the determined current capacity.

8. The system of claim 1 wherein the providing of the functionality of the online network protection service includes analyzing, by the one or more computing devices of the online network protection service, one or more responses of the subscribing host system to the forwarded portion of the filtered network traffic, and refining, by the one or more computing devices of the online network protection service, the set of rules to improve a throughput of the subscribing host system based on the analyzing of the one or more responses.

9. The system of claim 1 wherein the providing of the functionality of the online network protection service includes analyzing, by the one or more computing devices of the online network protection service, the rerouted network traffic to detect poison pill network traffic, and refining, by the one or more computing devices of the online network protection service, the set of rules to identify and filter out poison pill network traffic.

10. The system of claim 1 wherein the providing of the functionality of the online network protection service includes analyzing, by the one or more computing devices of the online network protection service, the rerouted network traffic to differentiate between legitimate network traffic and illegitimate network traffic, and refining, by the one or more computing devices of the online network protection service, the set of rules to filter out the illegitimate network traffic.

11. The system of claim 1 wherein the providing functionality of the online network protection service includes analyzing, by the one or more computing devices of the online network protection service, the rerouted network traffic to identify static responses to the forwarded portion of the filtered network traffic, caching the static responses in a data store of the online network protection service associated with the subscribing host system, and refining, by the one or more computing devices of the online network protection service, the set of rules to recognize a request resulting in a static response and to respond to the recognized request with one of the cached static responses in the data store.

12. The system of claim 1 wherein the providing of the functionality of the online network protection service includes identifying a rule that may be implemented by the subscribing host system and providing the identified rule to the subscribing host system for implementation on the subscribing host system.

13. The system of claim 1 wherein the providing of the functionality of the online network protection service includes logging information regarding the rerouted network traffic in a data store of the online network protection service, and analyzing the logged information regarding the rerouted network traffic.

14. A computer-implemented method comprising:

establishing, by one or more configured computing systems of an online network protection service that assists a plurality of clients of the online network protection service, and based on one or more electronic communications sent over one or more computer networks to the one or more configured computing systems, a subscription relationship with a subscribing host system as one of the plurality of clients, wherein the establishing of the subscription relationship includes using information supplied for the subscribing host system to determine an agreed-upon level of protective assistance for the online network protection service to provide to the subscribing host system, and wherein the information supplied for the subscribing host system specifies conditions under which the protective assistance of the online network protection service is to be activated;

determining, by the one or more configured computing systems and for the subscribing host system based at least in part on the supplied information, a set of rules for filtering network traffic directed to the subscribing host system;

providing, for the subscribing host system based at least in part on the agreed-upon level of protective assistance, one or more computing devices of the online network protection service to provide the protective assistance of the online network protection service to the subscribing host system;

causing, by the one or more configured computing systems and based at least in part on a determination that the specified conditions are satisfied, at least some of the network traffic directed to the subscribing host system to be rerouted to the provided one or more computing devices of the online network protection service instead of to the subscribing host system;

filtering, by the provided one or more computing devices of the online network protection service, the rerouted network traffic according to the set of rules; and

forwarding a portion of the filtered network traffic to the subscribing host system;

analyzing the rerouted network traffic; and

refining the set of rules based on the analyzing of the rerouted network traffic.

15. The method of claim 14 wherein the information supplied for the subscribing host system as part of the establishing of the subscription relationship further indicates a type of protective assistance specified by the subscribing host system for the online network protection service to provide to the subscribing host system under the specified conditions, and wherein the established subscription relationship includes a subscription by the subscribing host system to that type of protective assistance from the online network protection service.

16. The method of claim 14 further comprising storing, by the one or more configured computing systems, the set of rules at the online network protection service and further storing other rules for other subscribing host systems of the plurality of clients.

17. The method of claim 14 wherein the set of rules for filtering network traffic includes a set of condition/action pairs such that upon detection of a condition of a rule a corresponding action is taken.

18. The method of claim 17 wherein the set of condition/action pairs includes nested condition/action pairs.

19. The method of claim 14 wherein the set of rules for filtering network traffic includes a set of fuzzy logic statements.

20. The method of claim 14 further comprising determining a volume of network traffic that the subscribing host system can process, and wherein the filtering of the rerouted network traffic according to the set of rules is performed by the provided one or more computing devices and includes filtering the rerouted network traffic to be within the determined volume of network traffic.

21. The method of claim 14 wherein the analyzing of the rerouted network traffic is performed by the provided one or more computing devices and includes analyzing responsive network traffic of the subscribing host system to the forwarded portion of the filtered network traffic, and wherein the refining of the set of rules includes refining the set of rules to improve a throughput of the subscribing host system based on the analyzing of the responsive network traffic.

22. The method of claim 14 wherein the analyzing of the rerouted network traffic includes detecting poison pill network traffic, and wherein the refining of the set of rules is performed by the provided one or more computing devices and includes refining the set of rules to identify and filter out poison pill network traffic.

23. The method of claim 14 wherein the analyzing of the rerouted network traffic includes differentiating between legitimate network traffic and illegitimate network traffic, and wherein the refining of the set of rules includes refining the set of rules to identify and filter out illegitimate network traffic.

24. The method of claim 14 wherein the analyzing of the rerouted network traffic includes recognizing static responses to the forwarded portion of the filtered network traffic and caching the static responses in a data store of the online network protection service that is associated with the subscribing host system, and wherein the refining of the set of rules includes refining the set of rules to recognize a request resulting in a static response and to respond to the request with one of the cached static responses in the data store.

25. The method of claim 14 further comprising identifying a rule from the defined set of rules that may be implemented by the subscribing host system and providing the identified rule to the subscribing host system for implementation on the subscribing host system.

26. The method of claim 14 further comprising logging information regarding the rerouted network traffic in a data store of the online network protection service, and wherein the analyzing of the rerouted network traffic includes analyzing the logged information regarding the rerouted network traffic.

27. The method of claim 26 wherein the analyzing of the logged information includes analyzing the logged information asynchronously to the filtering of the rerouted network traffic and to the forwarding of the portion of the filtered network traffic to the subscribing host system.

28. A non-transitory computer-readable medium containing computer-executable instructions that when executed configure at least one computing devices of an online network protection service to:

establish, by the at least one configured computing device of the online network protection service, and based on one or more electronic communications sent over one or more computer networks to the at least one configured computing device, a relationship with a subscribing host system as one of a plurality of clients of the online network protection service, wherein the establishing of the relationship includes using information supplied for the subscribing host system to determine an agreed-upon level of protective assistance for the online network protection service to provide to the subscribing host system under specified conditions;

determine, by the at least one configured computing device and for the subscribing host system, a set of rules for filtering network traffic directed to the subscribing host system;

provide, for the subscribing host system based at least in part on the agreed-upon level of protective assistance, one or more computing devices of the online network protection service to provide processing capacity for filtering the network traffic directed to the subscribing host system;

cause, based at least in part on a determination that the specified conditions are satisfied, at least some of the network traffic directed to the subscribing host system to be rerouted to the provided one or more computing devices of the online network protection service instead of to the subscribing host system;

filter, by the provided one or more computing devices of the online network protection service, the rerouted network traffic according to the set of rules, and forwarding a portion of the filtered network traffic to the subscribing host system;

analyze the rerouted network traffic; and

refine the set of rules based on the analyzing of the rerouted network traffic.

29. The non-transitory computer-readable medium of claim 28 wherein the information supplied for the subscribing host system as part of the establishing of the relationship further indicates a type of protective assistance specified by the subscribing host system for the online network protection service to provide to the subscribing host system and indicates the specified conditions for use in identifying when to activate that type of protective assistance, and wherein the established relationship includes a subscription by the subscribing host system to that type of protective assistance from the online network protection service.

30. The non-transitory computer-readable medium of claim 29 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to store the set of rules in a data store of the online network protection service with other rules for other subscribing host systems of the plurality of clients.

31. The non-transitory computer-readable medium of claim 28 wherein the set of rules for filtering network traffic includes a set of condition/action pairs such that upon detection of a condition of a rule a corresponding action is taken.

32. The non-transitory computer-readable medium of claim 28 wherein the set of rules for filtering network traffic includes a set of fuzzy logic statements.

33. The non-transitory computer-readable medium of claim 28 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to determine a processing capacity of the subscribing host system, and wherein the filtering of the rerouted network traffic according to the set of rules is performed so that the filtered rerouted network traffic is based on the determined processing capacity.

34. The non-transitory computer-readable medium of claim 28 wherein the analyzing of the rerouted network traffic is performed by the provided one or more computing devices and includes analyzing responsive network traffic of the subscribing host system to the forwarded portion of the filtered network traffic, and wherein the refining of the set of rules includes refining the set of rules to improve a throughput of the subscribing host system based on the analyzing of the responsive network traffic.

35. The non-transitory computer-readable medium of claim 28 wherein the analyzing of the rerouted network traffic includes detecting poison pill network traffic, and wherein the refining of the set of rules includes refining the set of rules to identify and filter out poison pill network traffic.

36. The non-transitory computer-readable medium of claim 28 wherein the analyzing of the rerouted network traffic includes differentiating between legitimate network traffic and illegitimate network traffic, and wherein the refining of the set of rules is performed by the provided one or more computing devices and includes refining the set of rules to identify and filter out illegitimate network traffic.

37. The non-transitory computer-readable medium of claim 28 wherein the analyzing of the rerouted network traffic includes recognizing static responses to the forwarded portion of the filtered network traffic and caching the static responses in a data store of the online network protection service that is associated with the subscribing host system, and wherein the refining of the set of rules includes refining the set of rules to recognize a request resulting in a static response and to respond to the request with one of the cached static responses in the data store.

38. The non-transitory computer-readable medium of claim 28 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to identify a rule from the defined set of rules that may be implemented by the subscribing host system and to provide the identified rule to the subscribing host system for implementation on the subscribing host system.

39. The non-transitory computer-readable medium of claim 28 wherein the computer-executable instructions further configure the at least one computing device of the online network protection service to log in a data store of the online network protection service information regarding the network traffic directed to the subscribing host system, and wherein the analyzing of the rerouted network traffic includes analyzing the logged information.

40. The non-transitory computer-readable medium of claim 39 wherein the analyzing of the logged information includes analyzing the logged information asynchronously to the filtering of the rerouted network traffic and to the forwarding of the portion of the filtered network traffic to the subscribing host system.