Abstract: A method involves receiving data identifying a set of information technology (IT) resources of an IT infrastructure and generating a first IT resource dependency graph using the set of IT resources. First INCLUDES and EXCLUDES configuration data indicating one or more IT resources that should either be included or excluded from an IT resource group is received. Initial selection statuses for IT resources in the first dependency graph are set based on the first INCLUDES and EXCLUDES configuration data. A breadth-first search of the first dependency graph is performed to generate the IT resource group based on the initial selection status for the IT resources in the first dependency graph, and the IT infrastructure is updated or managed using the IT resource group.

Abstract: A method involves receiving, at a Global Resource Catalog (GRC) controller, credentials for one or more target networks within a distributed cloud network. For each target network, the GRC controller uses a respective network access methodology associated with that target network to identify and store a first set of target network resources associated with that network at a GRC database. The GRC controller links or groups a second set of target network resources of the first set of target network resources in the GRC database based on target network resource dependencies determined by the GRC controller. The GRC controller updates the second set of target network resources in the GRC database based on a received event or at a scheduled interval. A distributed cloud network is then updated based on the second set of target network resources stored at the GRC database.

Abstract: A control server receives probe data from a plurality of data centers indicating measured latencies with a first IP address associated with an origin server. The control server sums the measured latencies of a first data center having a lowest measured latency and a second data center. When the sum is below a threshold value, the control server determines the IP address to be an anycast IP address and selects a proper subset of the plurality of data centers as proxying data centers for other data centers in the plurality of data centers. When the sum is not below the threshold value, the control server determines the IP address to not be an anycast IP address and selects the first data center having the lowest measure latencies as the proxying data center for other data centers in the plurality of data centers.

Abstract: Methods and apparatuses for identifying a domain of a command and control server of a botnet are described. Upon receipt of a request to register a domain for a service that includes a proxy server, where the proxy server is to receive and process traffic for that domain if registration is successful, a determination of whether the domain was generated by a domain generation algorithm (DGA) is performed.

Abstract: A near end network optimizer receives, from a client device, a request for a network resource. Responsive to determining that a version of the network resource is stored in the near end network optimizer, a request for the network resource is transmitted to a far end network optimizer along with a version identifier that identifies that version. The near end network optimizer receives, from the far end network optimizer, a response that includes a differences file that specifies the difference(s) between the version of the network resource stored in the near end network optimizer with a most current version of the network resource. The response does not include the entire network resource. The near end network optimizer applies the specified difference(s) to the version that it has stored to generate an updated version of the network resource, and transmits the updated version of the network resource to the client device.

Abstract: A domain name is received from a customer. DNS is queried for multiple possible subdomains of the domain. For each subdomain that resolves, information about that subdomain's corresponding resource record is stored in a zone file that also includes a resource record for the domain name. The zone file is presented to the customer. A designation from the customer of which of the resource records are to point to an IP address of a proxy server is received. The resource records are modified according to the input of the customer and the zone file is propagated including the modified resource records.

Abstract: A proxy server in a cloud-based proxy service receives a secure session request from a client device for a secure session. The secure session request is received at the proxy server as a result of a Domain Name System (DNS) request for a domain resolving to the proxy server. The proxy server participates in a secure session negotiation with the client device including transmitting a digital certificate to the client device that is bound to domain and multiple other domains. The proxy server receives an encrypted request from the client device for an action to be performed on a resource that is hosted at an origin server corresponding to the domain. The proxy server decrypts the request and participates in a secure session negotiation with the origin server including receiving a digital certificate from the origin server. The proxy server encrypts the decrypted request using the digital certificate from the origin server and transmits the encrypted request to the origin server.

Abstract: A proxy server for limiting Internet connection speed of visitors that pose a threat. The proxy server receives from a client device a request to perform an action on an identified resource that is hosted at an origin server for a domain. The proxy server receives the request as a result of a DNS request for the domain resolving to the proxy server. The origin server is one of multiple origin servers that belong to different domains that resolve to the proxy server and are owned by different entities. The proxy server analyzes the request to determine whether a visitor belonging to the request poses a threat. If the proxy server determines that the visitor poses a threat, the proxy server reduces the speed at which the proxy server processes the request while keeping a connection to the client device open.

Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session with. The server transmits the encrypted premaster secret to the different server for decryption along with other information necessary to compute a master secret. The different server decrypts the encrypted premaster secret, generates the master secret, and transmits the master secret to the server. The server receives the master secret and continues with the handshake procedure including generating one or more session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server.

Abstract: A proxy server receives a request for a web page from a client device. In response to determining that a portion of the web page is available in cache, the proxy server retrieves that portion and transmits it to the client device. The portion of the web page is not the entire web page and is a prediction of the portion of the page that will remain static if the page is reloaded or requested by a different client device. The proxy server transmits a request to an origin server for the full web page. In response to receiving the full web page from the origin server, the proxy server modifies the full web page to remove the portion that was already transmitted to the client device, and transmits the modified web page to the client device.

Abstract: A Transmission Control Protocol (TCP) receiver receives a SYN segment from a TCP initiator that initiates a TCP handshake between the TCP initiator and a TCP server. A first value is extracted from a predefined portion of the SYN segment. A second value is computed using an authentication algorithm that includes at least using a cryptographic hash function that takes as input at least the source IP address of the encapsulating IP packet of the SYN segment and a shared secret between the TCP initiator and the TCP receiver. If the computed second value matches the extracted first value, then the TCP handshake is allowed to continue. If the computed second value does not match the extracted first value, then the TCP handshake is not allowed to continue.

Abstract: A near end network optimizer receives, from a client device, a request for a network resource. Responsive to determining that a version of the network resource is stored in the near end network optimizer, a request for the network resource is transmitted to a far end network optimizer along with a version identifier that identifies that version. The near end network optimizer receives, from the far end network optimizer, a response that includes a differences file that specifies the difference(s) between the version of the network resource stored in the near end network optimizer with a most current version of the network resource. The response does not include the entire network resource. The near end network optimizer applies the specified difference(s) to the version that it has stored to generate an updated version of the network resource, and transmits the updated version of the network resource to the client device.

Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server proxies messages to/from the different server including a set of signed cryptographic parameters signed using the private key on the different server. The different server generates the master secret, and generates and transmits the session keys to the server that are to be used in the secure session for encrypting and decrypting communication between the client device and the server.

Abstract: A proxy server in a cloud-based proxy service receives a message that indicates that a domain, whose traffic passes through the proxy server, may be under a denial-of-service (DoS) attack. The proxy server enables a rule for the domain that specifies that future requests for resources at that domain are subject to at least initially passing a set of one or more challenges. In response to receiving a request for a resource of that domain from a visitor, the proxy server presents the set of challenges that, if not passed, are an indication that that the visitor is part of the DoS attack. If the set of challenges are passed, the request may be processed. If the set of challenges are not passed, the request may be dropped.

Abstract: A proxy server automatically includes web applications in web pages at the network level. The proxy server receives, from a client device, a request for a network resource at a domain and is hosted at an origin server. The proxy server retrieves the requested network resource. The retrieved network resource does not include the web applications. The proxy server determines that the web applications are to be installed within the network resource. The proxy server automatically modifies the retrieved network resource to include the web applications. The proxy server transmits a response to the client device that includes the modified network resource. The network resource may remain unchanged at the origin server.

Abstract: A validating server receives from a client device a first request that does not include a cookie for a validating domain that resolves to the validating sever. The first request is received at the validating server as a result of a proxy server redirecting the client device to the validating domain upon a determination that a visitor belonging to the client device is a potential threat based on an IP (Internet Protocol) address assigned to the client device used for a second request to perform an action on an identified resource hosted on an origin server for an origin domain. The validating server sets a cookie for the client device, determines a set of characteristics associated with the first client device, and transmits the cookie and a block page to the client device that has been customized based on the set of characteristics, the block page indicating that the second request has been blocked.

Abstract: A transparent TCP proxy device intercepts TCP connection requests received from a TCP client and destined for a TCP server as if acting as the TCP server in a handshake with the TCP client. Only after completing the handshake with the TCP client, the transparent TCP proxy participates in a handshake with the TCP server as if acting as the TCP client. After the handshake with the TCP server is complete, the transparent TCP proxy intercepts and translates subsequent TCP packets received from the TCP client and destined for the TCP server into a form expected by the TCP server including updating an acknowledgement number and TCP checksum; and intercepts and translates subsequent TCP packets received from the TCP server and destined for the TCP client into a form expected by the TCP client including updating an acknowledgement number and TCP checksum.

Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session with. The server transmits the encrypted premaster secret to another server for decryption. The server receives the decrypted premaster secret and continues with the handshake procedure including generating a master secret from the decrypted premaster secret and generating one or more session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server.

Abstract: An Internet-based proxy service server accesses a set of visitor characteristics for multiple visitors to a set of one or more domains operated by a customer. The set of visitor characteristics are reported from a set of one or more proxy servers that are situated between client devices and a set of one or more origin servers for the set of domains. The service server causes the set of visitor characteristics to be displayed through a threat reporting interface that allows the customer to report visitors as posing an Internet security threat. The service server receives input from the customer through the threat reporting interface that at least one of the visitors poses an Internet security threat, and records that visitor as an Internet security threat in one or more threat databases that are used by the proxy servers when determining whether to allow visitors to access network resources hosted at a set of one or more origin servers.

Abstract: Message(s) are received from each one of multiple proxy servers, which are anycasted to the same IP address, that indicate source IP addresses of packets that are received that are directed to that same IP address. These proxy servers receive the packets as result of domain(s) resolving to that same IP address, and a particular one of the proxy servers receives the packets as a result of an anycast protocol implementation selecting that proxy server. Based on these message(s) from each of the proxy servers, a determination of the likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers is determined A message is transmitted to each of the proxy servers that indicates which source IP addresses of packets are not likely to be legitimately received at that proxy server.