Generally described, the present disclosure is directed to managing request routing functionality corresponding to resource requests for one or more resources associated with a content provider. The processing of the DNS requests by the service provider can include the selective filtering of DNS queries associated with a DNS query-based attack. A service provider can assign DNS servers corresponding to a distributed set of network addresses, or portions of network addresses, such that DNS queries exceeding a threshold, such as in DNS query-based attacks, can be filtered in a manner that can mitigate performance impact on for the content provider or service provider.

Implementations of the present disclosure involve a system and/or method for identifying and mitigating malicious network threats. Network data associated is retrieved from various sources across a network and analyzed to identify a malicious network threat. When a threat is found, the system performs a mitigating action to neutralize the malicious network threat.

A signaling controller (DSC) performs dynamic management in networks such as Evolved Packet Core (EPC) networks that rely on Diameter signaling interfaces. The controller executes in real time a self-adjusting algorithm that achieves user-based service continuity during signaling storms or congestion situations. The algorithm is self-adjusting on the basis of comparing a signaling and peer group values which are dynamically determined. The dynamic determination of these values is based on items such as signaling message weight and a base value for a network user.

A software evaluation method includes obtaining a number of requests from a transmission source other than a transmission source registered in advance from among requests to software, and at least one of an log output amount of logs output through the software and a number of log outputs of the logs, and generating information on evaluation of the software in accordance with the obtained number of requests and at least one of the obtained log output amount and the obtained number of log outputs.

Methods and systems for detecting Denial-of-Service (DoS) attacks on a network. The method includes clustering connection requests received at the network during a first collection time having a first time span based on communication datasets extracted therefrom. For at least one connection cluster, a first DoS attack detection algorithm is executed to determine a first probability that the connection cluster is associated with a DoS attack. The first confidence score is compared with a first threshold to determine whether a mitigation order is to be generated. The connection cluster is adjusted by extracting second communication datasets from connection requests received at the network during a second collection time having a second time span longer than the first time span, and a second DoS attack detection algorithm is executed to determine a second probability that the connection cluster is associated with a DoS attack.

A method and network are provided for monitoring a network during a DDoS attack. The method includes establishing a flow record for flows designated for tarpitting and a state machine, each state of multiple states of the state machine having an associated handler function. The handler function associated with a current state of a state machine associated with a flow is invoked to perform one or more actions associated with the flow or the flow record for applying at least one tarpitting technique of one or more candidate tarpitting techniques associated with the flow record, and return a next state, which is used to update the current state of the state machine. The handler function associated with the current state of the state machine is repeatedly invoked, wherein each invocation of the handler function potentially applies different tarpitting techniques.

Systems and methods for an improved DDoS mitigation approach are provided. According to one embodiment, a current threshold for a network connection characteristic is established within a Denial-of-Service (DoS) mitigation device logically interposed between a protected resource of a private network and multiple client devices residing external to the private network. A number of connections between the client devices and the protected network resource are tracked. During a period of time in which the number of connections exceeds a connection count threshold: (i) for each of the connections, a measured value for the network connection characteristic is compared to the current threshold; (ii) responsive to a determination that the measured value exceeds the current threshold, the connection is dropped; and (iii) the current threshold is periodically reduced, such that only those connections complying with the current threshold are maintained.

Generally described, the present disclosure is directed to managing request routing functionality corresponding to resource requests for one or more resources associated with a content provider. The processing of the DNS requests by the service provider can include the selective filtering of DNS queries associated with a DNS query-based attack. A service provider can assign DNS servers corresponding to a distributed set of network addresses, or portions of network addresses, such that DNS queries exceeding a threshold, such as in DNS query-based attacks, can be filtered in a manner that can mitigate performance impact on for the content provider or service provider.

Provided are methods and systems for dynamically limiting new sessions. A method for dynamically limiting new sessions may commence with initiating a dynamic session rate limiter based on predetermined criteria. The method may further include dynamically ascertaining, by the dynamic session rate limiter, a remaining session table capacity. The method may continue with dynamically limiting, by the dynamic session rate limiter, a number of new sessions according to a function selected to negatively correlate the new sessions and the remaining session table capacity.

Methods and systems for an integrated solution to the rate based denial of service attacks targeting the Session Initiation Protocol are provided. According to one embodiment, header, state, rate and content anomalies are prevented and network policy enforcement is provided for session initiation protocol (SIP). A hardware-based apparatus helps identify SIP rate-thresholds through continuous and adaptive learning. The apparatus can determine SIP header and SIP state anomalies and drop packets containing those anomalies. SIP requests and responses are inspected for known malicious contents using a Content Inspection Engine. The apparatus integrates advantageous solutions to prevent anomalous packets and enables a policy based packet filter for SIP.