Using a content delivery network for security monitoring

• US 9,825,980 B2
• Filed: 05/24/2017
• Issued: 11/21/2017
• Est. Priority Date: 08/26/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Serban, Cristina
• Primary Examiner(s): HOANG, HIEU T
• Application Number:
  US15/603,925
• Publication Number:
  US 20170257387A1
• Time in Patent Office: 181 Days
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/885 Monitoring specific for caches
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

A content delivery network includes a plurality of cache servers. Each cache server is configured to receive a request for content from a client system and receive content and security data from a content server. Each cache server is further configured to provide the content to the client system and provide the security data to a monitoring system.

Claims

1. A system, comprising:

a memory that stores instructions; and

a processor that executes the instructions to perform operations, the operations comprising;

determining, based on a comparison of a first security data file received from a first cache server with a second security data file received from a second cache server, if a change in operation of a content server has occurred, wherein the first security data file is provided to the first cache server by the content server and is cached at the first cache server, wherein the second security data file is provided to the second cache server by the content server and is cached at the second cache server, wherein the first security data file and the second security data file include security data associated with the content server.

2. The system of claim 1, wherein the operations further comprise analyzing the security data from the first and second security data files.

3. The system of claim 1, wherein the operations further comprise requesting content from the content server.

4. The system of claim 1, wherein the operations further comprise comparing the first security data file to the second security data file based on a time period during which the first and second security data files are received from the first and second cache servers respectively.

5. The system of claim 1, wherein the operations further comprise periodically polling the first cache server to determine if new security data is available.

6. The system of claim 1, wherein the operations further comprise generating an alert if the change in the operation of the content server is determined to have occurred.

7. The system of claim 1, wherein the operations further comprise determining that an attacker gained access to the content server if the change in the operation of the content server is determined to have occurred.

8. The system of claim 1, wherein the operations further comprise disconnecting the content server from a network if the change in the operation of the content server is determined to have occurred.

9. The system of claim 1, wherein the operations further comprise activating logging software within a network to record network activity associated with the content server.

10. The system of claim 1, wherein the operations further comprise detecting a system error based on analyzing log file information included in the security data.

11. The system of claim 1, wherein the operations further comprise monitoring the content server if the change in the operation of the content server is determined to have occurred.

12. The system of claim 1, wherein the operations further comprise initiating a transfer of new content from the content server when a software update for a client system is released.

13. The system of claim 1, wherein the operations further comprise providing content received from the content server to a client system.

14. A method, comprising:

detecting, based on a comparison of a first security data file received from a first cache server with a second security data file received from a second cache server, if a change in operation of a content server has occurred, wherein the detecting is performed by utilizing instructions from a memory that are executed by a processor, wherein the first security data file is provided to the first cache server by the content server and is cached at the first cache server, wherein the second security data file is provided to the second cache server by the content server and is cached at the second cache server, wherein the first security data file and the second security data file include security data associated with the content server.

15. The method of claim 14, further comprising determining that the change in the operation of the content server has occurred based on malicious activity detected from the comparison.

16. The method of claim 14, further comprising determining that the change in the operation of the content server has occurred based on a configuration change detected from the comparison.

17. The method of claim 14, further comprising generating an alert if the change in the operation of the content server is determined to have occurred.

18. The method of claim 17, further comprising transmitting the alert to an administrator.

19. The method of claim 14, further comprising retrieving additional security data associated with the content server from the first and second cache servers.

20. A computer-readable device comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:

determining, based on a comparison of a first security data file received from a first cache server with a second security data file received from a second cache server, if a change in operation of a content server has occurred, wherein the first security data file is provided to the first cache server by the content server and is cached at the first cache server, wherein the second security data file is provided to the second cache server by the content server and is cached at the second cache server, wherein the first security data file and the second security data file include security data associated with the content server.