Determining the likelihood of traffic being legitimately received at a proxy server in a cloud-based proxy service

• US 9,641,549 B2
• Filed: 02/04/2014
• Issued: 05/02/2017
• Est. Priority Date: 08/07/2012
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Holloway, Lee Hahn, Rao, Srikanth N., Prince, Matthew Browning, Tourne, Matthieu Philippe Franois, Pye, Ian Gerald, Bejjani, Ray Raymond, Rodery, Jr., Terry Paul
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US14/172,823
• Publication Number:
  US 20140157416A1
• Time in Patent Office: 1,183 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Message(s) are received from each one of multiple proxy servers, which are anycasted to the same IP address, that indicate source IP addresses of packets that are received that are directed to that same IP address. These proxy servers receive the packets as result of domain(s) resolving to that same IP address, and a particular one of the proxy servers receives the packets as a result of an anycast protocol implementation selecting that proxy server. Based on these message(s) from each of the proxy servers, a determination of the likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers is determined. A message is transmitted to each of the proxy servers that indicates which source IP addresses of packets are not likely to be legitimately received at that proxy server.

Claims

1. A method in a first one of a plurality of proxy servers that are anycasted to a same IP address, the method comprising:

receiving, at the first one of the plurality of proxy servers, a first packet that has a first source IP address, wherein the first packet is received at the first proxy server as a result of an anycast protocol implementation selecting that first proxy server as the closest out of the plurality of proxy servers in terms of routing protocol metric used to route traffic to the plurality of proxy servers, and wherein the first proxy server is in a different geographic location than other ones of the plurality of proxy servers;

determining, using a data structure that indicates a plurality of source IP addresses from which packets are not likely to be legitimately received at that first proxy server, whether the received first packet is likely to be legitimately received at the first proxy server, wherein the data structure is built based on historical analysis of source IP addresses of packets received at the plurality of proxy servers when there is not currently a denial of service (DoS) attack associated with the plurality of proxy servers that are anycasted, and wherein the received first packet is likely to be legitimately received at the first proxy server when a probability determined using the historical analysis is above a threshold value, the probability retrieved from a probability map; and

blocking the received first packet responsive to a determination that the received first packet is not likely to be legitimately received at the first proxy server, wherein determining using the data structure that the received first packet is not likely to be legitimately received at the first proxy server is an indication that a legitimate packet having that first source IP address should be received at a different one of the plurality of proxy servers.

2. The method of claim 1, further comprising:

receiving, at the proxy server, a message from a central server that includes a set of rules to block packets received with source IP addresses that are not likely to be legitimately received by that first proxy server.

3. The method of claim 1, wherein the data structure specifies the source IP addresses of packets that are likely to be legitimately received at that first proxy server.

4. The method of claim 1, wherein the data structure specifies the source IP addresses of packets that are not likely to be legitimately received at that first proxy server.

5. The method of claim 1, further comprising:

receiving, at the first proxy server, a message that indicates a suspension of blocking further packets destined to the IP address of the first proxy server.

6. An apparatus, comprising:

a plurality of proxy servers that are anycasted to a same destination IP address, wherein each of the plurality of proxy servers is configured to perform the following;

receive packets at the same destination IP address, wherein this proxy server receives the packets at the same destination IP address as a result of an anycast protocol implementation selecting this one of the plurality of proxy servers as the closest in terms of routing protocol metric used to route traffic to the plurality of proxy servers;

transmit one or more messages to a central server computer that indicate source IP addresses of the received packets;

receive, from the central server computer, a message that indicates a plurality of source IP addresses of packets that are not likely to be legitimately received at that proxy server, wherein the packets are not likely to be legitimately received at that proxy server when a probability determined using a historical analysis of source IP addresses of packets received at the plurality of proxy servers when there is not currently a denial of service (DoS) attack associated with the plurality of proxy servers that are anycasted is below a threshold value, the probability retrieved from a probability map;

install, based on the received message, one or more rules to rate limit packets that are received having a source IP address that is not likely to be legitimately received at that proxy server but rather should be received at a different one of the proxy servers; and

rate limit packets, based on the one or more rules, that that are received having a source IP address that is not likely to be legitimately received at that proxy server but rather should be received at a different one of the proxy servers; and

the central server computer coupled with the plurality of proxy servers, wherein the central server computer is configured to perform the following;

receive, from each of the plurality of proxy servers, the one or more messages that indicate source IP addresses of the received packets;

determine, based on the one or more messages received from the plurality of proxy servers, a likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers; and

transmit, to each of the proxy servers, the message that indicates which source IP addresses of packets are not likely to be legitimately received at that proxy server.

7. The apparatus of claim 6, wherein the message transmitted to each of the proxy servers includes a set of rules to rate limit packets received with source IP addresses that are not likely to be legitimately received by that proxy server.

8. The apparatus of claim 6, wherein the message transmitted to each of the proxy servers includes a set of rules to block packets received with source IP addresses that are not likely to be legitimately received by that proxy server.

9. The apparatus of claim 6, wherein the message transmitted to each of the proxy servers specifies the source IP addresses of packets that are likely to be legitimately received at that proxy server.

10. The apparatus of claim 6, wherein the message transmitted to each of the proxy servers specifies the source IP addresses of packets that are not likely to be legitimately received at that proxy server.

11. The apparatus of claim 6, wherein the proxy servers are configured to transmit the one or more messages to the central server computer that indicate source IP addresses of the received packets only when the destination IP address of those packets is not indicated as currently being under a denial of service (DoS) attack.

12. The apparatus of claim 6, wherein the one or more messages to be transmitted by each of the proxy servers further indicates a number of packets of each source IP address received at that proxy server.

13. The apparatus of claim 6, wherein the one or more messages to be transmitted by each of the proxy servers are to be transmitted as a result of a client-side script that is inserted by the proxy servers into web pages of domains that resolve to the same IP address, wherein the client-side script, when executed, causes a packet to be transmitted to the same IP address.

14. The apparatus of claim 6, further comprising:

responsive to a network event that affects the likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers, transmitting a message to the proxy servers that indicates a suspension of any rate limits that have been installed as a result of transmitting the messages to the proxy servers that indicate which source IP addresses of packets are not likely to be legitimately received at the proxy servers.

15. A non-transitory computer-readable storage medium that provides instructions that, if executed by a processor of a first one of a plurality of proxy servers that are anycasted to a same IP address, will cause said processor to perform operations comprising:

receiving, at a first one of the plurality of proxy servers, a first packet that has a first source IP address, wherein the first packet is received at the first proxy server as a result of an anycast protocol implementation selecting that first proxy server as the closest out of the plurality of proxy servers in terms of routing protocol metric used to route traffic to the proxy servers, and wherein the first proxy server is in a different geographic location than other ones of the plurality of proxy servers;

determining, using a data structure that indicates a plurality of source IP addresses from which packets are not likely to be legitimately received at that first proxy server, whether the received first packet is likely to be legitimately received at the first proxy server, wherein the data structure is built based on historical analysis of source IP addresses of packets received at the plurality of proxy servers when there is not currently a denial of service (DoS) attack associated with the plurality of proxy servers that are anycasted, and wherein the received first packet is likely to be legitimately received at the first proxy server when a probability determined using the historical analysis is above a threshold value, the probability retrieved from a probability map; and

blocking the received first packet responsive to a determination that the received first packet is not likely to be legitimately received at the first proxy server, wherein determining using the data structure that the received first packet is not likely to be legitimately received at the first proxy server is an indication that a legitimate packet having that first source IP address should be received at a different one of the plurality of proxy servers.

16. The non-transitory computer-readable storage medium of claim 15, wherein the operations further comprise:

receiving, at the proxy server, a message from a central server that includes a set of rules to block packets received with source IP addresses that are not likely to be legitimately received by that first proxy server.

17. The non-transitory computer-readable storage medium of claim 15, wherein the data structure specifies the source IP addresses of packets that are likely to be legitimately received at that first proxy server.

18. The non-transitory computer-readable storage medium of claim 15, wherein the data structure specifies the source IP addresses of packets that are not likely to be legitimately received at that first proxy server.

19. The non-transitory computer-readable storage medium of claim 15, wherein the operations further comprise:

receiving, at the first proxy server, a message responsive to a network event that affects the likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers, transmitting a message to the proxy servers that indicates a suspension of blocking further packets destined to the IP address of the first proxy server.