Detecting adverse network conditions for a third-party network site

• US 9,548,961 B2
• Filed: 09/28/2015
• Issued: 01/17/2017
• Est. Priority Date: 03/27/2007
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Nordstrom, Paul G., Bodell, Colin, Woods, Craig A.
• Primary Examiner(s): CHANG, KENNETH W
• Application Number:
  US14/868,171
• Publication Number:
  US 20160021061A1
• Time in Patent Office: 477 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A network protection service for providing protective assistance to a subscribing host is presented. The network protection service is configured determine a set of rules for filtering network traffic for a subscribing host. The network protection service is further configured to receive network traffic on behalf of the subscribing host, filter the received network traffic according to the set of rules, and forward a portion of the filtered network traffic to the subscribing host. Still further, the network protection service is configured to analyze the received network traffic via the analysis server, and refine the set of rules for filtering the received network traffic based on the analysis of the received network traffic by the analysis server.

Claims

1. A system comprising:

one or more computing devices; and

one or more memories with stored instructions that, when executed by the one or more computing devices, cause the one or more computing devices to provide functionality of an online network protection service by;

receiving, based at least in part on a request from a client that is supplied to the online network protection service via one or more electronic communications sent over one or more computer networks between the online network protection service and a computing device of the client, instructions to monitor for specified conditions;

determining, by the online network protection service, that network traffic directed to a host system of the client satisfies the specified conditions;

causing, by the online network protection service and based at least in part on the specified conditions being satisfied, at least a subset of the network traffic directed to the host system to be rerouted to the one or more computing devices instead of to the host system; and

forwarding, to the host system by the one or more computing devices, and based at least in part on information supplied by the client in the one or more electronic communications, a portion of the rerouted network traffic that is not rejected by the online network protection service.

2. The system of claim 1 wherein the receiving of the instructions includes receiving instructions to establish a relationship involving the online network protection service providing protective assistance to the host system under the specified conditions, and wherein the stored instructions further cause the one or more computing devices to establish the relationship and to provide the protective assistance to the host system.

3. The system of claim 1 wherein the online network protection service provides a plurality of computing devices that include the one or more computing devices, and wherein the causing of the at least subset of the network traffic to be rerouted to the one or more computing devices of the online network protection service includes allocating, by the online network protection service and in response to the determining that the network traffic directed to the host system satisfies the specified conditions, computing resources of the online network protection service to assist the host system that include the one or more computing devices.

4. The system of claim 1 wherein the receiving of the instructions includes receiving, by the online network protection service, information from the client that specifies a type of protective assistance for the online network protection service to provide to the host system, and wherein the stored instructions further cause the online network protection service to determine rules for use in providing the specified type of protective assistance to the host system.

5. The system of claim 1 wherein the receiving of the instructions includes receiving, by the online network protection service, information from the client that indicates the specified conditions, and wherein the stored instructions further cause the online network protection service to determine that the network traffic directed to the host system satisfies the specified conditions by monitoring the network traffic directed to the host system and identifying the specified conditions being satisfied.

6. The system of claim 1 wherein the receiving of the instructions includes receiving, by the online network protection service, information from the client that indicates how to filter network traffic directed to the host system, and wherein the stored instructions further cause the online network protection service to analyze the rerouted network traffic and to reject some of the rerouted network traffic based at least in part on the received information.

7. The system of claim 1 wherein the determining that the network traffic directed to the host system satisfies the specified conditions includes receiving, by the online network protection service, an electronic communication from the host system that includes information related to the specified conditions.

8. The system of claim 1 wherein the determining that the network traffic directed to the host system satisfies the specified conditions is based at least in part on identifying, by the online network protection service, a lack of communications from the host system.

9. The system of claim 1 wherein the determining that the network traffic directed to the host system satisfies the specified conditions includes receiving, by the online network protection service, information sent to the online network protection service by a human representative of the client that identifies the specified conditions.

10. The system of claim 1 wherein the providing of the functionality of the online network protection service includes determining, by the online network protection service, a current capacity of the host system for processing network traffic, and selecting, by the online network protection service, the portion of the rerouted network traffic to forward to the host system based at least in part on the determined current capacity.

11. The system of claim 1 wherein the providing of the functionality of the online network protection service includes analyzing, by the one or more computing devices of the online network protection service, one or more responses of the host system to the forwarded portion of the rerouted network traffic, and further providing protective assistance to the host system based at least in part on the analyzing of the one or more responses.

12. The system of claim 1 wherein the providing of the functionality of the online network protection service includes analyzing, by the one or more computing devices of the online network protection service, the rerouted network traffic to identify an attack on the host system, and selecting the portion of the rerouted network traffic to forward to the host system to be legitimate network traffic that is not part of the attack.

13. The system of claim 1 wherein the providing of the functionality of the online network protection service includes caching, by the one or more computing devices of the online network protection service, responses of the host system to received requests, and further providing protective assistance to the host system based at least in part on the cached responses.

14. A computer-implemented method comprising:

receiving, by an online network protection service implemented on one or more computing systems and via one or more electronic communications sent over one or more computer networks between the one or more computing systems and a computing device of a client, a request for the online network protection service to provide protective assistance to a host system of the client during specified conditions indicated by the client and in a manner based on information supplied by the client;

providing, by the online network protection service, the protective assistance to the host system, including monitoring network traffic directed to the host system and identifying the specified conditions;

causing, by the online network protection service and based at least in part on the identifying of the specified conditions, at least some of the network traffic directed to the host system to be rerouted to the online network protection service instead of to the host system;

rejecting, by the online network protection service, a first portion of the rerouted network traffic; and

forwarding, to the host system by the online network protection service, a second portion of the rerouted network traffic that is not rejected.

15. The computer-implemented method of claim 14 wherein the online network protection service includes multiple computing devices, and wherein the causing of the at least some of the network traffic to be rerouted to the online network protection service includes allocating, by the online network protection service and in response to the identifying of the specified conditions, one or more computing devices of the multiple computing devices to assist the host system, and wherein the rejecting and the forwarding are performed by the allocated one or more computing devices.

16. The computer-implemented method of claim 14 wherein the receiving of the request includes, by the online network protection service, receiving information from the client that specifies a type of protective assistance for the online network protection service to provide to the host system and establishing a relationship between the client and the online network protection service, and wherein the providing of the protective assistance to the host system includes providing the specified type of protective assistance.

17. The computer-implemented method of claim 14 wherein the receiving of the request includes, by the online network protection service, receiving information from the client that indicates how to filter network traffic directed to the host system, and wherein the rejecting of the first portion of the rerouted network traffic is based at least in part on the received information.

18. A non-transitory computer-readable medium containing computer-executable instructions that, when executed, configure one or more computing devices of an online network protection service to at least:

receive, by the one or more computing devices of the online network protection service via one or more electronic communications sent over one or more computer networks between the online network protection service and a computing device of a client, a request for the online network protection service to provide protective assistance to a host system of the client under specified conditions indicated by the client and based on information supplied by the client;

provide, by the one or more computing devices of the online network protection service, the protective assistance to the host system, including monitoring network traffic directed to the host system and identifying the specified conditions;

cause, by the one or more computing devices of the online network protection service, and based at least in part on the identifying of the specified conditions, at least some of the network traffic directed to the host system to be rerouted to the online network protection service instead of to the host system; and

manage, by the online network protection service, the rerouted network traffic on behalf of the host system.

19. The non-transitory computer-readable medium of claim 18 wherein the managing of the rerouted network traffic on behalf of the host system includes rejecting, by the one or more computing devices of the online network protection service, a first portion of the rerouted network traffic, and forwarding, to the host system by the one or more computing devices of the online network protection service, a second portion of the rerouted network traffic that is not rejected.

20. The non-transitory computer-readable medium of claim 18 wherein the online network protection service includes multiple computing devices, and wherein the causing of the at least some of the network traffic to be rerouted to the online network protection service includes allocating, by the online network protection service and in response to the identifying of the specified conditions, at least one computing device of the multiple computing devices to assist the host system, and wherein managing of the rerouted network traffic is performed by the allocated at least one computing device.