GB2570543B8 - Detecting triggering events for distributed denial of service attacks - Google Patents
Detecting triggering events for distributed denial of service attacks Download PDFInfo
- Publication number
- GB2570543B8 GB2570543B8 GB1817377.3A GB201817377A GB2570543B8 GB 2570543 B8 GB2570543 B8 GB 2570543B8 GB 201817377 A GB201817377 A GB 201817377A GB 2570543 B8 GB2570543 B8 GB 2570543B8
- Authority
- GB
- United Kingdom
- Prior art keywords
- triggering events
- distributed denial
- service attacks
- detecting triggering
- detecting
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3055—Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3466—Performance evaluation by tracing or monitoring
- G06F11/3476—Data logging
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
- H04L9/3265—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate chains, trees or paths; Hierarchical trust model
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/144—Detection or countermeasures against botnets
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/146—Tracing the source of attacks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Computer Hardware Design (AREA)
- Computer Networks & Wireless Communication (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Quality & Reliability (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/136,762 US10938781B2 (en) | 2016-04-22 | 2016-04-22 | Secure labeling of network flows |
US15/136,687 US11277416B2 (en) | 2016-04-22 | 2016-04-22 | Labeling network flows according to source applications |
GB1816827.8A GB2564357B8 (en) | 2016-04-22 | 2016-06-29 | Detecting triggering events for distributed denial of service attacks |
Publications (5)
Publication Number | Publication Date |
---|---|
GB201817377D0 GB201817377D0 (en) | 2018-12-12 |
GB2570543A GB2570543A (en) | 2019-07-31 |
GB2570543B GB2570543B (en) | 2020-05-20 |
GB2570543A8 GB2570543A8 (en) | 2020-09-30 |
GB2570543B8 true GB2570543B8 (en) | 2021-12-08 |
Family
ID=60116990
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
GB1817377.3A Active GB2570543B8 (en) | 2016-04-22 | 2016-06-29 | Detecting triggering events for distributed denial of service attacks |
GB1817376.5A Active GB2574283B8 (en) | 2016-04-22 | 2016-06-29 | Detecting triggering events for distributed denial of service attacks |
GB1816827.8A Active GB2564357B8 (en) | 2016-04-22 | 2016-06-29 | Detecting triggering events for distributed denial of service attacks |
Family Applications After (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
GB1817376.5A Active GB2574283B8 (en) | 2016-04-22 | 2016-06-29 | Detecting triggering events for distributed denial of service attacks |
GB1816827.8A Active GB2564357B8 (en) | 2016-04-22 | 2016-06-29 | Detecting triggering events for distributed denial of service attacks |
Country Status (2)
Country | Link |
---|---|
GB (3) | GB2570543B8 (en) |
WO (1) | WO2017184189A1 (en) |
Families Citing this family (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10938781B2 (en) | 2016-04-22 | 2021-03-02 | Sophos Limited | Secure labeling of network flows |
US11277416B2 (en) | 2016-04-22 | 2022-03-15 | Sophos Limited | Labeling network flows according to source applications |
US11102238B2 (en) | 2016-04-22 | 2021-08-24 | Sophos Limited | Detecting triggering events for distributed denial of service attacks |
US10986109B2 (en) | 2016-04-22 | 2021-04-20 | Sophos Limited | Local proxy detection |
US11165797B2 (en) | 2016-04-22 | 2021-11-02 | Sophos Limited | Detecting endpoint compromise based on network usage history |
CN114374560A (en) * | 2018-02-07 | 2022-04-19 | 阿里巴巴集团控股有限公司 | Data processing method, device and storage medium |
RU2740027C1 (en) * | 2020-02-12 | 2020-12-30 | Варити Менеджмент Сервисез Лимитед | Method and system for preventing malicious automated attacks |
US11381594B2 (en) * | 2020-03-26 | 2022-07-05 | At&T Intellectual Property I, L.P. | Denial of service detection and mitigation in a multi-access edge computing environment |
US20220239634A1 (en) * | 2021-01-26 | 2022-07-28 | Proofpoint, Inc. | Systems and methods for sensor trustworthiness |
US20240007483A1 (en) * | 2022-07-01 | 2024-01-04 | Nozomi Networks Sagl | Method for automatic signatures generation from a plurality of sources |
CN115589307B (en) * | 2022-09-07 | 2024-07-16 | 支付宝(杭州)信息技术有限公司 | Risk monitoring method and device for distributed system |
Family Cites Families (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7930740B2 (en) * | 2005-07-07 | 2011-04-19 | International Business Machines Corporation | System and method for detection and mitigation of distributed denial of service attacks |
US8490190B1 (en) * | 2006-06-30 | 2013-07-16 | Symantec Corporation | Use of interactive messaging channels to verify endpoints |
US8156557B2 (en) * | 2007-01-04 | 2012-04-10 | Cisco Technology, Inc. | Protection against reflection distributed denial of service attacks |
US8782786B2 (en) * | 2007-03-30 | 2014-07-15 | Sophos Limited | Remedial action against malicious code at a client facility |
US8769702B2 (en) * | 2008-04-16 | 2014-07-01 | Micosoft Corporation | Application reputation service |
US8561181B1 (en) * | 2008-11-26 | 2013-10-15 | Symantec Corporation | Detecting man-in-the-middle attacks via security transitions |
CA2789243A1 (en) * | 2009-03-13 | 2010-09-16 | Rutgers, The State University Of New Jersey | Systems and methods for the detection of malware |
KR100942456B1 (en) * | 2009-07-23 | 2010-02-12 | 주식회사 안철수연구소 | Method for detecting and protecting ddos attack by using cloud computing and server thereof |
US8832835B1 (en) * | 2010-10-28 | 2014-09-09 | Symantec Corporation | Detecting and remediating malware dropped by files |
US20120324568A1 (en) * | 2011-06-14 | 2012-12-20 | Lookout, Inc., A California Corporation | Mobile web protection |
WO2014026718A1 (en) * | 2012-08-17 | 2014-02-20 | Nokia Siemens Networks Oy | Data services in a computer system |
US9503324B2 (en) * | 2013-11-05 | 2016-11-22 | Harris Corporation | Systems and methods for enterprise mission management of a computer network |
US9967282B2 (en) * | 2014-09-14 | 2018-05-08 | Sophos Limited | Labeling computing objects for improved threat detection |
US20170091482A1 (en) * | 2015-09-30 | 2017-03-30 | Symantec Corporation | Methods for data loss prevention from malicious applications and targeted persistent threats |
-
2016
- 2016-06-29 GB GB1817377.3A patent/GB2570543B8/en active Active
- 2016-06-29 GB GB1817376.5A patent/GB2574283B8/en active Active
- 2016-06-29 GB GB1816827.8A patent/GB2564357B8/en active Active
- 2016-06-29 WO PCT/US2016/040094 patent/WO2017184189A1/en active Application Filing
Also Published As
Publication number | Publication date |
---|---|
GB201816827D0 (en) | 2018-11-28 |
GB201817377D0 (en) | 2018-12-12 |
GB2564357B8 (en) | 2021-12-08 |
WO2017184189A1 (en) | 2017-10-26 |
GB2574283A (en) | 2019-12-04 |
GB2574283B8 (en) | 2021-12-08 |
GB2570543B (en) | 2020-05-20 |
GB2570543A (en) | 2019-07-31 |
GB2574283B (en) | 2020-05-20 |
GB2564357A (en) | 2019-01-09 |
GB201817376D0 (en) | 2018-12-12 |
GB2570543A8 (en) | 2020-09-30 |
GB2564357B (en) | 2020-10-07 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
GB2570543B8 (en) | Detecting triggering events for distributed denial of service attacks | |
IL266252A (en) | Iot security service | |
ZA201807517B (en) | Validation of pal protection areas | |
IL257852B (en) | Systems and methods for detecting and preventing spoofing | |
EP3195172A4 (en) | Blocking forgiveness for ddos | |
DK3241146T3 (en) | SYSTEM AND PROCEDURE FOR COVERING AN IDENTIFICATOR FOR THE PROTECTION OF THE IDENTIFIER FROM UNPERMITTED APPROPRIATION | |
EP3590063C0 (en) | Detecting malicious behavior within local networks | |
GB201720990D0 (en) | Security service for an unmanaged device | |
GB2543952B (en) | Advanced local-network threat response | |
GB2555384B (en) | Preventing phishing attacks | |
GB2544309B (en) | Advanced local-network threat response | |
GB201517511D0 (en) | Method for privacy protection | |
GB2574093B (en) | Malware barrier | |
GB2545491B (en) | Protection against malicious attacks | |
EP3325376A4 (en) | An impact protection device clip | |
GB2543813B (en) | Improved malware detection | |
ITUB20154000A1 (en) | Protection device for lock | |
GB201611301D0 (en) | Endpoint malware detection using an event graph | |
GB2573076B (en) | Endpoint malware detection using an event graph | |
SG10201610911WA (en) | Intrusion detection system | |
GB2548570B (en) | Support for an edge protection barrier | |
GB2563266B (en) | Denial of service mitigation | |
GB2534242B (en) | Fire protection barrier | |
HK1223243A2 (en) | Thermal protection for speakers | |
GB201522887D0 (en) | Detecting malicious software |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
S117 | Correction of errors in patents and applications (sect. 117/patents act 1977) |
Free format text: REQUEST FILED; REQUEST FOR CORRECTION UNDER SECTION 117 FILED ON 18 OCTOBER 2021 |
|
S117 | Correction of errors in patents and applications (sect. 117/patents act 1977) |
Free format text: CORRECTIONS ALLOWED; REQUEST FOR CORRECTION UNDER SECTION 117 FILED ON 18 OCTOBER 2021 ALLOWED ON 25 NOVEMBER 2021 |