Using recurrent neural networks to defeat DNS denial of service attacks

Patent metadata

Field	Value
Publication number	US-10044751-B2
Application number	US-201514981738-A
Country	US
Kind code	B2
Filing date	Dec 28, 2015
Priority date	Dec 28, 2015
Publication date	Aug 7, 2018
Grant date	Aug 7, 2018

Abstract

A system for mitigating network attacks is provided. The system includes a protected network including a plurality of devices. The system further includes one or more attack mitigation devices communicatively coupled to the protected network. The attack mitigation devices are configured and operable to employ a recurrent neural network (RNN) to obtain probability information related to a request stream. The request stream may include a plurality of at least one of: HTTP, RTSP and/or DNS messages. The attack mitigation devices are further configured to analyze the obtained probability information to detect one or more atypical requests in the request stream. The attack mitigation services are also configured and operable to perform, in response to detecting one or more atypical requests, mitigation actions on the one or more atypical requests in order to block an attack.

First claim

What is claimed is:

1. A system for mitigating network attacks, the system comprising:
a protected network comprising a plurality of devices; and
one or more attack mitigation devices communicatively coupled to the protected network, wherein the one or more attack mitigation devices are configured and operable to employ a recurrent neural network (RNN) programmed to use a Backpropagation Through Time (BPTT) method to obtain total request probability information related to a request stream, wherein the request stream comprises a plurality of at least one of: HTTP (hypertext transfer protocol), RTSP (Real Time Streaming Protocol) and/or DNS (Domain Name System protocol) messages and wherein the total request probability information represents a probability of a respective request message string being a valid one and wherein the total request probability information related to the request stream is obtained by multiplying language-conditional character probabilities for each character included in the request message; analyze the obtained total request probability information using the BPTT method to detect one or more atypical requests in the request stream and perform, in response to detecting the one or more atypical requests, one or more mitigation actions on the one or more atypical requests in order to block an attack including: (1) determining a rate at which a source associated with a particular atypical request sends atypical requests and (2) blocking the source in response to determining that the rate exceeds a predefined threshold.

2. The system as recited in claim 1 , wherein the one or more attack mitigation devices is further configured to train the employed RNN by presenting the RNN with preselected valid request samples from a database.

3. The system as recited in claim 1 , wherein the atypical request comprises a randomly generated request.

4. The system as recited in claim 1 , wherein the RNN models sequential dependencies in a sequence of characters included in each request message.

5. The system as recited in claim 2 , wherein the one or more attack mitigation devices is further configured to train the employed RNN in at least one of off-line phase and live phase.

6. The system as recited in claim 1 , wherein the one or more mitigation actions further comprise:
determining a total rate of the received atypical requests in the request stream; and
dropping the one or more atypical requests in response to determining that the total rate exceeds a predefined threshold.

7. The system as recited in claim 6 , wherein the determination that the total rate exceeds the predefined threshold is made using a token bucket rate technique.

8. The system as recited in claim 1 , wherein the attack comprises a dictionary DDoS attack.

9. An attack mitigation device communicatively coupled to a protected network, the attack mitigation device comprising logic integrated with and/or executable by a processor, the logic being adapted to:
obtain total request probability information related to a request stream using a recurrent neural network (RNN) programmed to use a Backpropagation Through Time (BPTT) method, the request stream comprising a plurality of at least one of: HTTP (hypertext transfer protocol), RTSP (Real Time Streaming Protocol) and/or DNS (Domain Name System protocol) messages, the total request probability information represents a probability of a respective request message string being a valid one;
analyze the obtained total request probability information to detect one or more atypical requests in the request stream using the BPTT method; and
perform, in response to detecting the one or more atypical requests, one or more mitigation actions on the one or more atypical requests in order to block an attack including: (1) determining a rate at which a source associated with a particular atypical request sends atypical requests and (2) blocking the source in response to determining that the rate exceeds a predefined threshold.

10. The attack mitigation device as recited in claim 9 , wherein device is further coupled to a database and wherein the logic is further adapted to train the RNN by presenting the RNN with preselected valid request samples from the database.

11. The attack mitigation device as recited in claim 9 , wherein the atypical request comprises a randomly generated request.

12. The attack mitigation device as recited in claim 9 , wherein the RNN models sequential dependencies in a sequence of characters included in each request message.

13. The attack mitigation device as recited in claim 10 , wherein the logic is further adapted to train the employed RNN in at least one of off-line phase and live phase.

14. The attack mitigation device as recited in claim 9 , wherein the logic adopted to perform one or more mitigation actions is further adapted to:
determine a total rate of the received atypical requests in the request stream; and
drop the one or more atypical requests in response to determining that the total rate exceeds a predefined threshold.

15. The attack mitigation device as recited in claim 9 , wherein the determination that the total rate exceeds the predefined threshold is made using a token bucket rate technique.

16. The attack mitigation device as recited in claim 9 , wherein the attack comprises a dictionary DDoS attack.

Assignees

• Arbor Networks Inc

Inventors

• Huston Iii Lawrence B

Classifications

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06N3/02

  Neural networks · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06N3/084

  Backpropagation, e.g. using gradient descent · CPC title