Detecting volumetric attacks

US10425443B2 · kind B2 · utility

Assignee

• MICROSOFT TECHNOLOGY LICENSING, LLC · US

Inventors

• Royi Ronen · Nes Ziona, IL
• Hani Neuvirth-Telem · Nes Ziona, IL
• Shai Baruch Nahum · Netanya, IL
• Yuri Gabaev · Givatayim, IL
• Oleg Yanovsky · Petah Tikva, IL
• Vlad Korsunsky · Lod, IL
• Tomer Teller · Nes Ziona, IL
• Hanan Shteingart · Herzliya, IL

Key dates

• Filing date: Jun 14, 2016
• Grant date: Sep 24, 2019
• Expiry date: Nov 15, 2036

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L63/1425
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

Detecting a volumetric attack on a computer network with fewer false positives and while also requiring fewer processing resources is provided. The systems and methods described herein use observations taken at the network level to observe network traffic to form a predictive model for future traffic. When the network's future traffic sufficiently exceeds the predictive model, the monitoring systems and methods will indicate to the network to take security measures. The traffic to the network may be observed in subsets, corresponding to various groupings of sources, destinations, and protocols so that security measures may be targeted to that subset without affecting other machines in the network.