Using a content delivery network for security monitoring

• US 9,667,638 B2
• Filed: 11/12/2015
• Issued: 05/30/2017
• Est. Priority Date: 08/26/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Serban, Cristina
• Primary Examiner(s): Hoang, Hieu
• Application Number:
  US14/938,988
• Publication Number:
  US 20160065602A1
• Time in Patent Office: 565 Days
• Field of Search: 709202, 709224, 709227-228
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/885 Monitoring specific for caches
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

A content delivery network includes a plurality of cache servers. Each cache server is configured to receive a request for content from a client system and receive content and security data from a content server. Each cache server is further configured to provide the content to the client system and provide the security data to a monitoring system.

Claims

1. A system, comprising:

a memory that stores instructions; and

a processor that executes the instructions to perform operations, the operations comprising;

determining, based on a first security data file received from a first cache server and based on a comparison of the first security data file with a second security data file received from a second cache server, if a change in operation of a content server has occurred, wherein the first security data file is provided to the first cache server by the content server and is cached at the first cache server, wherein the second security data file is provided to the second cache server by the content server and is cached at the second cache server, wherein the first security data file includes first security data associated with the content server, and wherein the second security data file includes second security data associated with the content server; and

generating an alert if the change in the operation of the content server is determined to have occurred.

2. The system of claim 1, wherein the operations further comprise determining that the change in the operation of the content server has occurred based on a configuration change indicated by the comparison.

3. The system of claim 1, wherein the operations further comprise determining that the change in the operation of the content server has occurred based on malicious activity detected based on the comparison.

4. The system of claim 1, wherein the operations further comprise determining that the change in the operation of the content server has occurred based on a hardware malfunction detected based on the comparison.

5. The system of claim 1, wherein the operations further comprise receiving a request for content from a client system.

6. The system of claim 5, wherein the operations further comprise receiving, in response to receiving the request for the content, the content and the first security data file from the content server.

7. The system of claim 6, wherein the operations further comprise caching the content at the first cache server after receiving the content from the content server.

8. The system of claim 7, wherein the operations further comprise providing the content to the client system.

9. The system of claim 1, wherein the operations further comprise identifying the change in the operation of the content server.

10. The system of claim 1, wherein the operations further comprise disconnecting the content server from a network if the change in the operation of the content server is determined to have occurred.

11. The system of claim 1, wherein the operations further comprise activating, after detecting an anomaly based on the first security data file, logging hardware to record network activity.

12. The system of claim 1, wherein the operations further comprise monitoring the content server if the change in the operation of the content server is determined to have occurred.

13. The system of claim 1, wherein the operations further comprise determining that the change in the operation of the content server has occurred based on comparing the first security data file to a historical trend associated with the content server.

14. A method, comprising:

determining, based on a first security data file received from a first cache server and based on a comparison of the first security data file with a second security data file received from a second cache server, if a change in operation of a content server has occurred, wherein the determining is performed by utilizing instructions from a memory that are executed by a processor, wherein the first security data file is provided to the first cache server by the content server and is cached at the first cache server, wherein the second security data file is provided to the second cache server by the content server and is cached at the second cache server, wherein the first security data file includes first security data associated with the content server, and wherein the second security data file includes second security data associated with the content server; and

transmitting an alert if the change in the operation of the content server is determined to have occurred.

15. The method of claim 14, further comprising generating the alert if the change in the operation of the content server is determined to have occurred.

16. The method of claim 14, further comprising analyzing a log file to identify a system error associated with the content server.

17. The method of claim 14, further comprising monitoring a configuration file to detect unauthorized activity associated with the content server.

18. The method of claim 14, further comprising monitoring the content server if the change in the operation of the content server is determined to have occurred.

19. The method of claim 14, further comprising activating, after detecting an anomaly based on the first security data file, logging hardware to record network activity associated with the content server.

20. A computer-readable device comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:

determining, based on a first security data file received from a first cache server and based on a comparison of the first security data file with a second security data file received from a second cache server, if a change in operation of a content server has occurred, wherein the first security data file is provided to the first cache server by the content server and is cached at the first cache server, wherein the second security data file is provided to the second cache server by the content server and is cached at the second cache server, wherein the first security data file includes first security data associated with the content server, and wherein the second security data file includes second security data associated with the content server; and

transmitting an alert if the change in the operation of the content server is determined to have occurred.