Detecting network attacks based on network requests

Patent metadata

Field	Value
Publication number	US-9756058-B1
Application number	US-201414500532-A
Country	US
Kind code	B1
Filing date	Sep 29, 2014
Priority date	Sep 29, 2014
Publication date	Sep 5, 2017
Grant date	Sep 5, 2017

Abstract

Techniques for analyzing access to a network-based document may be provided. For example, the network-based document may be configured for direct access from client device. Based on an access of a client device to the network-based document, information associated with this access may be recorded. The information may be analyzed to determine whether a condition associated with the direct access may be violated. An issue may be detected with the client device access based on a determination that the condition may be violated.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
generating, by a computer system, a network-based document configured for direct access from client devices, the direct access comprising access by the client devices independent of a redirection to the network-based document via a proxy computing device;
updating, by the computer system, a network-based resource to cause a client device of the client devices to access the network-based document, the network-based resource comprising the network-based document;
providing, to the client device, access to the network-based resource based at least in part on a domain name system record associated with a domain of the network-based document, the domain name system record stored at a computing resource of an Internet service provider;
recording, by the computer system, information associated with the client device accessing the network-based document, the information comprising a request from the client device to access the network-based document based at least in part on the access to the network-based resource;
determining that the client device accessed the network-based document based at least in part on an unauthorized redirection via the proxy computing device, the unauthorized redirection determined based at least in part on the request from the information;
updating a number of determined unauthorized redirections of the client devices to the network-based document based at least in part on the unauthorized redirection of the client device;
detecting an unauthorized change to the domain name system record at the computing resource of the Internet service provider based at least in part on the number of determined unauthorized redirections; and
initiating a corrective action based at least in part on the unauthorized change to the domain name system record, the corrective action comprising a notification of the unauthorized change, an analysis of data associated with accesses of the client devices to the network-based document and with the access of the client device to the network-based document, and an identification that the domain name system record has been altered based at least in part on the analysis.

2. The computer-implemented method of claim 1 , wherein the network-based resource comprises a web site, wherein the network-based document comprises a web page, wherein a likelihood of the client device being redirected to the network-based document is reduced by one or more of: hiding the web page from affiliates, disabling web crawling to the web page, changing an address of the web page at time intervals, or including random content in the web page, and wherein updating the network-based resource comprises including an object in code of the web site configured to generate the request to the web page independent of a web request to the web site.

3. The computer-implemented method of claim 2 , wherein the information comprises a log of the request, and wherein determining that the client device accesses the network-based document based at least in part on an unauthorized redirection comprises identifying a referrer header in the log.

4. The computer-implemented method of claim 1 , wherein the number of determined unauthorized redirections of the client devices to the network-based document is based at least in part on unauthorized redirections via the proxy computing device of the accesses of the client devices to the network-based document, wherein the accesses are previous accesses of the client devices to the network-based document relative to the access of the client device to the network-based document.

5. One or more non-transitory computer-readable storage media storing computer-executable instructions that, when executed by one or more computing systems, configure the one or more computing systems to perform operations comprising:
generating a network-based document configured for direct access from client devices, the direct access being independent of a redirection to the network-based document via a proxy computing device;
updating a network-based resource to cause a client device to access the network-based document, the network-based resource comprising the network-based document;
providing, to the client device, access to the network-based resource based at least in part on a domain name system record of a domain associated with the network-based document, the domain name system record stored at a computing resource of an Internet service provider;
recording information associated with the access of the client device to the network-based document-based at least in part on the client device accessing the network-based resource, the information comprising a request from the client device to access the network-based document,
analyzing at least the request from the information to determine whether a condition associated with the direct access is violated;
detecting an issue with the client device access based at least in part on determining that the condition is violated, the issue comprising an unauthorized redirection to the network-based document via the proxy computing device;
updating a number of detected unauthorized redirections of the client devices to the network-based document based at least in part on the unauthorized redirection of the client device;
detecting an unauthorized change to the domain name system record at the computing resource of the Internet service provider based at least in part on the number of detected unauthorized redirections; and
initiating a corrective action based at least in part on the unauthorized change to the domain name system record, the corrective action comprising a notification of the unauthorized change, an analysis of accesses of the client devices to the network-based document and of the access of the client device to the network-based document, and an identification that the domain name system record has been altered based at least in part on the analysis.

6. The one or more non-transitory computer-readable storage media of claim 5 , wherein the direct access comprises enabling the client devices to access the network-based document without redirection.

7. The one or more non-transitory computer-readable storage media of claim 5 , wherein allowing access to the network-based document comprises:
associating the network-based document with the network-based resource;
updating code of a network-based resource to include an object configured to request the network-based document; and
providing the object to a client device in response to an access request associated with the network-based resource, the providing at least causing the client device to request access to the network-based document.

8. The one or more non-transitory computer-readable storage media of claim 7 , wherein recording information associated with the client device access comprises storing data associated with the request of the client device to access the network-based document.

9. The one or more non-transitory computer-readable storage media of claim 8 , wherein the condition is violated based at least in part on determining that the data comprises one or more of: a referrer header, a Hypertext Transfer Protocol 302 status, or a cookie of an unauthorized party.

10. The one or more non-transitory computer-readable storage media of claim 5 , wherein the one or more computing systems comprise the client device, and wherein allowing access to the network-based document comprises:
receiving, by the client device, an address of the network-based document over an out-of-band channel;
executing, at the client device, an application configured to generate the request to access the network-based document based

Assignees

• Amazon Tech Inc

Inventors

• Jezorek Matthew Ryan
• Van Horenbeeck Maarten
• Lai Richie

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• H04L63/123 Primary

  received data contents, e.g. message integrity · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title