Abstract: A method and system for mitigating a threat associated with network data packets are provided. The method commences with receiving, by an authentication server, a request for access to a server from a client. The method further includes authenticating the client by the authentication server. The authentication includes providing an authentication token to the client. The method continues with receiving, by a mitigation device, from the client, at least one network packet directed to the server. The at least one network packet embeds the authentication token. The method further includes validating, by the mitigation device, authenticity of the authentication token and selectively forwarding, based on the validation, the at least one network packet to the server. The authentication token is independently generated by the authentication server, the mitigation device, and the server using a shared token generation algorithm based on a hash salt value.

Abstract: A method and system for mitigating a threat associated with network data packets are provided. The method commences with receiving, by an authentication server, a request for access to a server from a client. The method further includes authenticating the client by the authentication server. The authentication includes providing an authentication token to the client. The method continues with receiving, by a mitigation device, from the client, at least one network packet directed to the server. The at least one network packet embeds the authentication token. The method further includes validating, by the mitigation device, authenticity of the authentication token and selectively forwarding, based on the validation, the at least one network packet to the server. The authentication token is independently generated by the authentication server, the mitigation device, and the server using a shared token generation algorithm based on a hash salt value.

Abstract: A method and system for mitigating a threat associated with network data packets are provided. The method commences with receiving, by an authentication server, a request for access to a server from a client. The method further includes authenticating the client by the authentication server. The authentication includes providing an authentication token to the client. The method continues with receiving, by a mitigation device, from the client, at least one network packet directed to the server. The at least one network packet embeds the authentication token. The method further includes validating, by the mitigation device, authenticity of the authentication token and selectively forwarding, based on the validation, the at least one network packet to the server. The authentication token is independently generated by the authentication server, the mitigation device, and the server using a shared token generation algorithm based on a hash salt value.

Abstract: Provided are methods and systems for cluster-based mitigation of a network attack. A method for cluster-based mitigation of a network attack may commence with detecting an unusual pattern in network data traffic associated with data sources. The method may further include extracting signature parameters associated with the network data traffic. The signature parameters may be indicative of the network attack. The method may continue with assigning importance weights to the signature parameters based on historical signature data to generate weighted signature parameters. The method may further include building a decision tree for the data sources based on the weighted signature parameters. The method may continue with creating an optimal number of clusters for the data sources based on an analysis of the decision tree. The method may further include selectively taking at least one mitigating action with regard to the data sources within the clusters.

Abstract: Provided are methods and systems for a Transmission Control Protocol (TCP) state handoff of a data traffic flow. A method for a TCP state handoff of a data traffic flow comprises determining a TCP state at predetermined times by a state machine unit. The TCP state includes data concerning a session between a client and a server. The TCP state for the predetermined times is stored to a database. A request to apply a predetermined policy to the session is received by a transaction processing unit and, in response to the request, a session request associated with the session between the client and the server is sent to an access control unit. The session request is processed by the access control unit based on the TCP state and according to the predetermined policy.

Abstract: Provided are methods and systems for cluster-based mitigation of a network attack. A method for cluster-based mitigation of a network attack may commence with detecting an unusual pattern in network data traffic associated with data sources. The method may further include extracting signature parameters associated with the network data traffic. The signature parameters may be indicative of the network attack. The method may continue with assigning importance weights to the signature parameters based on historical signature data to generate weighted signature parameters. The method may further include building a decision tree for the data sources based on the weighted signature parameters. The method may continue with creating an optimal number of clusters for the data sources based on an analysis of the decision tree. The method may further include selectively taking at least one mitigating action with regard to the data sources within the clusters.

Abstract: Provided are methods and systems for cluster-based determination of signatures for detection of anomalous data traffic. An example method may include capturing, by a network module, data packets routed to a destination. The method may further include grouping, by at least one processor in communication with the network module, the data packets into clusters. The method may also include detecting, by the processor, an anomaly in the data packets and, in response to the detection, determining, by the processor and based on the clusters, one or more signatures associated with the data packets. The method may further include generating, by the processor and based on the signatures, one or more rules for allowing the data packets. The method may further include providing, by the processor, the one or more rules to a policy enforcement point associated with the destination.

Abstract: Provided are methods and systems for mitigating a distributed denial of service (DDoS) event. The method may commence with sending a request to a health monitor concerning a state of a network. The method may continue with attributing a lack of response to the request from the health monitor to be an indication of a collapse of a collapsible virtual data circuit associated with network data traffic. The collapsible virtual data circuit may be designed to collapse in response to the DDoS event in the network. The method may include redirecting the network data traffic associated with the collapsible virtual data circuit based on the indication of the collapse of the collapsible virtual data circuit.

Abstract: Provided are methods and systems for cluster-based mitigation of a network attack. A method for cluster-based mitigation of a network attack may commence with detecting an unusual pattern in network data traffic associated with data sources. The method may further include extracting signature parameters associated with the network data traffic. The signature parameters may be indicative of the network attack. The method may continue with assigning importance weights to the signature parameters based on historical signature data to generate weighted signature parameters. The method may further include building a decision tree for the data sources based on the weighted signature parameters. The method may continue with creating an optimal number of clusters for the data sources based on an analysis of the decision tree. The method may further include selectively taking at least one mitigating action with regard to the data sources within the clusters.

Abstract: In response to communications between one or more given networks and one or more other networks, a network protection appliance discovers one or more computing resources of the one or more given networks from a plurality of protocol layers of the received communications. The network protection appliance also gleans properties of the one or more discovered computing resources of the one or more given networks from the plurality of protocol layers of the received communications. The network protection appliance maps the gleaned properties of the one or more discovered computing resources of the one or more given networks to a plurality of network protection policies. The network protection appliance also determines an applicable network protection policy for processing a corresponding received communication from the mapping of the gleaned properties of the one or more discovered given computing resources of the one or more given networks to the plurality of network protection policies.

Abstract: Provided are methods and systems for a Transmission Control Protocol (TCP) state handoff of a data traffic flow. A method for a TCP state handoff of a data traffic flow comprises determining a TCP state at predetermined times by a state machine unit. The TCP state includes data concerning a session between a client and a server. The TCP state for the predetermined times is stored to a database. A request to apply a predetermined policy to the session is received by a transaction processing unit and, in response to the request, a session request associated with the session between the client and the server is sent to an access control unit. The session request is processed by the access control unit based on the TCP state and according to the predetermined policy.

Abstract: Provided are methods and systems for a Transmission Control Protocol (TCP) state handoff of a data traffic flow. A method for a TCP state handoff of a data traffic flow comprises determining a TCP state at predetermined times by a state machine unit. The TCP state includes data concerning a session between a client and a server. The TCP state for the predetermined times is stored to a database. A request to apply a predetermined policy to the session is received by a transaction processing unit and, based on the request, a session request associated with the session between the client and the server is sent to an access control unit. The session request is processed by the access control unit based on the TCP state and according to the predetermined policy.

Abstract: Provided are methods and systems for cluster-based determination of signatures for detection of anomalous data traffic. An example method may include capturing, by a network module, data packets routed to a destination. The method may further include grouping, by at least one processor in communication with the network module, the data packets into clusters. The method may also include detecting, by the processor, an anomaly in the data packets and, in response to the detection, determining, by the processor and based on the clusters, one or more signatures associated with the data packets. The method may further include generating, by the processor and based on the signatures, one or more rules for allowing the data packets. The method may further include providing, by the processor, the one or more rules to a policy enforcement point associated with the destination.

Abstract: Provided are methods and systems for cluster-based mitigation of a network attack. A method for cluster-based mitigation of a network attack may commence with detecting an unusual pattern in network data traffic associated with data sources. The method may further include extracting signature parameters associated with the network data traffic. The signature parameters may be indicative of the network attack. The method may continue with assigning importance weights to the signature parameters based on historical signature data to generate weighted signature parameters. The method may further include building a decision tree for the data sources based on the weighted signature parameters. The method may continue with creating an optimal number of clusters for the data sources based on an analysis of the decision tree. The method may further include selectively taking at least one mitigating action with regard to the data sources within the clusters.

Abstract: Methods and systems for dynamic threat protection are disclosed. An example method for dynamic threat protection may commence with receiving real-time contextual data from at least one data source associated with a client. The method may further include analyzing the real-time contextual data to determine a security threat score associated with the client. The method may continue with assigning, based on the analysis, the security threat score to the client. The method may further include automatically applying a security policy to the client. The security policy may be applied based on the security threat score assigned to the client.

Abstract: Provided are methods and systems for mitigating a distributed denial of service (DDoS) event. The method may commence with sending a request to a health monitor concerning a state of a network. The method may continue with attributing a lack of response to the request from the health monitor to be an indication of a collapse of a collapsible virtual data circuit associated with network data traffic. The collapsible virtual data circuit may be designed to collapse in response to the DDoS event in the network. The method may include redirecting the network data traffic associated with the collapsible virtual data circuit based on the indication of the collapse of the collapsible virtual data circuit.

Abstract: Provided are methods and systems for mitigating a DDoS event. The method may comprise receiving an indication of a collapse of a collapsible virtual data circuit associated with network data traffic. In response to the received indication of the collapse, the collapse may be attributed to the DDoS event. Furthermore, the method may comprise redirecting the network data traffic to one or more DDoS mitigation services. The method may further comprise mitigating the DDoS event by the one or more DDoS mitigation services.

Abstract: Passive monitoring of a large-scale network using multiple tiers of ordinary network switches, as opposed to purpose-built network monitoring hardware, is accomplished by initially providing network communications to an initial tier of monitoring switches, either from existing switches that copy frames and provide them to the monitoring switches, or from network taps to which the monitoring switches are connected. The initial tier of monitoring switches comprises flow tables that initially simply drop all frames provided to those switches and, subsequently, when specific network issues arise, they are modified to include a specification particular frame criteria whose frames are either forwarded to subsequent tiers of monitoring switches, or statistics regarding those frames are collected. Subsequent tiers of monitoring switches receive frames from the initial tier and direct them to one or more appropriate analysis computing devices.

Abstract: Provided are methods and systems for mitigating a DDoS event. The method may comprise receiving an indication of a collapse of a collapsible virtual data circuit associated with network data traffic. In response to the received indication of the collapse, the collapse may be attributed to the DDoS event. Furthermore, the method may comprise redirecting the network data traffic to one or more DDoS mitigation services. The method may further comprise mitigating the DDoS event by the one or more DDoS mitigation services.

Abstract: Methods and systems for dynamic threat protection are disclosed. An example method for dynamic threat protection may commence with receiving real-time contextual data from at least one data source associated with a client. The method may further include analyzing the real-time contextual data to determine a security threat score associated with the client. The method may continue with assigning, based on the analysis, the security threat score to the client. The method may further include automatically applying a security policy to the client. The security policy may be applied based on the security threat score assigned to the client.