Distributed defensive architecture (DDA) against distributed denial of service (DDOS) attack

Abstract

The present disclosure provides various systems, methods, and devices that may be used to defending against Distributed Denial of Service (DDoS) attacks. In one aspect, the disclosure provides method for defending against a DDoS attack implementable by a web server. The web server can generate indirect authentication credentials (IACs) based on authentication credentials associated with user accounts and share the IACs with an intermediary server. The intermediary server can be, for example, an internet server provider server or a proxy server. The web server can further detect an anomaly based on web traffic directed to the web server and instruct the intermediary server to validate subsequent web traffic directed to the web server based on the IACs. Thereafter, the web server can receive validated web traffic directed to the web server via the intermediary server.

Description

TITLE DISTRIBUTED DEFENSIVE ARCHITECTURE (DDA) AGAINST DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKTECHNICAL FIELD

[0001] At least some aspects of the present disclosure relate to cyber security, such as, for example, securing a web server against Denial of Service and Distributed Denial of Service attacks.BACKGROUND

[0002] A malicious actor may attempt to disrupt services provided by a web server using a Denial of Service (DoS) attack. To carry out the DoS attack, the malicious actor typically causes the web server to be flooded with requests. The flood of requests can overwhelm the web server and therefore render the web server unable to processes legitimate requests from client devices.

[0003] A Distributed Denial of Service (DDoS) attack is a type of DoS attack where the requests flooding the web server originate from multiple different sources. For example, a malicious actor may execute a DDoS attack using a network of Internet-connected devices (e.g., personal computers, smartphones, Internet-of-Things devices) that each send requests to the web server. In some cases, the network of Internet-connected devices is a “botnet” of devices infected with malware that is programmed to cause the devices to act as “bots” for the malicious actor and send the requests to web server.

[0004] DDoS attacks can be especially difficult to defend against due to the distributed nature of the incoming requests. For example, because the web server is receiving both malicious requests and legitimate requests originating from multiple different devices, it can be difficult to identify which devices are sending the malicious requests and block incoming traffic therefrom.

[0005] Accordingly, there exists a need for systems, methods, and devices for defending against DoS and DDoS attacks. The present disclosure provides various solutions that employ a distributed defensive architecture (DDA).SUMMARY

[0006] In one aspect, the present disclosure provides a computer-implemented method. The computer-implemented method can include receiving, by a web server, client requests via an intermediary server and detecting, by the web server, an anomaly related to the client requests. The computer-implemented method can further include instructing, by the webserver, the intermediary server to validate subsequent client requests and receiving, by the web server, validated subsequent client requests from the intermediary server.

[0007] In another aspect, the present disclosure provides a computer-implemented method. The computer-implemented method can include receiving, by an intermediary server, client requests directed to a web server and forwarding, by the intermediary server, the client requests to the web server. The computer-implemented method can further include receiving, by the intermediary server, an instruction from the web server to validate subsequent client requests. The instruction can be based on an anomaly detected related to the client requests. The computer-implemented method can further include receiving, by the intermediary server, the subsequent client requests, validating, by the intermediary server, the subsequent client requests, and forwarding, by the intermediary server, validated subsequent client requests to the web server.

[0008] In yet another aspect, the present disclosure provides a web server. The web server can include a processor and a memory comprising instructions executable by the processor. The instructions can cause the processor to generate indirect authentication credentials (lACs) based on authentication credentials associated with user accounts and share the lACs with an intermediary server. The intermediary server can be, for example, an internet server provider server or a proxy server. The instructions can further cause the processor to detect an anomaly based on web traffic directed to the web server, instruct the intermediary server to validate subsequent web traffic directed to the web server based on the lACs, and receive validated web traffic directed to the web server via the intermediary server.BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In the description, for purposes of explanation and not limitation, specific details are set forth, such as particular aspects, procedures, techniques, etc. to provide a thorough understanding of the present technology. However, it will be apparent to one skilled in the art that the present technology may be practiced in other aspects that depart from these specific details.

[0010] The accompanying drawings, together with the detailed description below, are incorporated in and form part of the specification, and serve to further illustrate aspects of concepts that include the claimed disclosure and explain various principles and advantages of those aspects.

[0011] The apparatuses and methods disclosed herein have been represented whereappropriate by conventional symbols in the drawings, showing only those specific details that are pertinent to understanding the various aspects of the present disclosure so as not to obscure the disclosure with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein.

[0012] FIG. 1 illustrates a diagram of a web traffic system, according to at least one aspect of the present disclosure.

[0013] FIG. 2A illustrates a diagram of a web traffic system during a Distributed Denial of Service (DDoS) attack, according to at least one aspect of the present disclosure.

[0014] FIG. 2B illustrates a diagram of the web traffic system of FIG. 2A employing a Distributed Defensive Architecture (DDA) to mitigate the DDoS attack, according to at least one aspect of the present disclosure.

[0015] FIG. 3 is a flow diagram of a method for initializing a DDA based on detecting a potential DDoS attack, according to at least one aspect of the present disclosure.

[0016] FIG. 4 is a flow diagram of a method for executing a DDA to mitigate a potential DDoS attack, according to at least one aspect of the present disclosure.

[0017] FIG. 5 is a flow diagram of a method for protecting a web server from anomalous web traffic, which may be carried out by a web server, according to at least one aspect of the present disclosure.

[0018] FIG. 6 is a flow diagram of a method for protecting a web server from anomalous web traffic, which may be carried out by an intermediary server, according to at least one aspect of the present disclosure.

[0019] FIG. 7 is a block diagram of a computer apparatus with data processing subsystems or components, according to at least one aspect of the present disclosure.

[0020] FIG. 8 is a diagrammatic representation of an example system that includes a host machine, according to at least one aspect of the present disclosure.

[0021] Corresponding reference characters indicate corresponding parts throughout the several views. The exemplifications set out herein illustrate various aspects of the present disclosure, in one form, and such exemplifications are not to be construed as limiting the scope of the disclosure in any manner.DESCRIPTION

[0022] Before explaining various forms of the devices, systems, and methods disclosed herein, it should be noted that the forms are illustrative and are not limited in application oruse to the details of construction and arrangement of components illustrated in the accompanying drawings and description. The illustrative forms may be implemented or incorporated in other forms, variations and modifications, and may be practiced or carried out in various ways. Further, unless otherwise indicated, the terms and expressions utilized herein have been chosen for the purpose of describing the illustrative forms for the convenience of the reader and are not for the purpose of limitation thereof. Also in the following description, it is to be understood that terms such as “forward,” “rearward,” “left,” “right,” “above,” “below,” “upwardly,” “downwardly,” and the like are words of convenience and are not to be construed as limiting terms.

[0023] As explained above, a malicious actor may attempt to disrupt services provided by a web server by executing a Denial of Service (DoS) attack that overwhelms the web server with superfluous requests, thereby rendering the web server unable to processes legitimate requests from client devices. In some instances, the DoS attack can be a Distributed Denial of Service (DDoS) attack. DDoS attacks may employ one or more than one botnet to send the superfluous requests to the web server from multiple different sources. Thus, DDoS attacks may be especially difficult to defend against.

[0024] By rendering web servers unable to processes legitimate requests from client devices, DoS and DDoS attacks can be harmful to companies associated with the web servers. For example, companies such as social medial companies, streaming services, and online commerce companies are often reliant on web servers to deliver products to consumers. DoS and DDoS attacks can significantly slow or disable a company’s web servers, which can not only prevent the company from delivering products to consumers but also negatively affect the company’s reputation and consumers’ willingness to conduct future business with the company. Accordingly, there exists a need for systems, methods, and devices for defending against DoS and DDoS attacks.

[0025] The present disclosure provides various systems, methods, and devices for defending against DoS and DDoS attacks and / or other anomalous web traffic that may negatively affect a web server. For example, in various aspects, the present disclosure provides a method for protecting a web server from anomalous web traffic. According to the method, the web server receives client requests via an intermediary server and detects an anomaly related to the client requests. In one aspect, the detected anomaly is an increase in the volume of the client requests, which may be indicative of a potential DDoS attack. Based on detecting the anomaly, the web server instructs the intermediary server to enter a defense mode that causes the intermediary server to validate subsequent client requests. Thereafter, the web server receives validated subsequent client requests from the intermediary server. Subsequent client requests that the intermediary server is not able tovalidate (e.g., malicious client requests sent as part of a DDoS attack) are not forwarded to the web server. Thus, various systems, methods, and devices method can provide the technical benefit of preventing the web server from continued exposure to anomalous web traffic, for example, from a DDoS attack, that could overwhelm or otherwise negatively affect the web server.

[0026] In some aspects of the example method referenced above, the intermediary server validates the subsequent client requests based on indirect authentication credentials (lACs) generated by the web server. For example, the web server can generate the lACs based on authentication credentials that are typically used to authenticate users requesting access to a resource of the web server (e.g., authentication credentials such as usernames, passwords, and / or tokens stored in an authentication credentials database). In one aspect, the lACs are generated by salting and hashing the authentication credentials. The web server shares the lACs with the intermediary server. Further, subsequent client requests sent from client devices to the web server via the intermediary server can include additional headers that include corresponding lACs. The intermediary server can compare the lACs comprised in the subsequent client requests to the lACs shared by the web server to validate the subsequent client requests. Therefore, by using the lACs, the intermediary server can validate the subsequent client requests without having access to users’ actual authentication credentials. Furthermore, the intermediary server may not have access to the salts used to generate the lACs and is therefore unable to derive users’ actual authentication credentials from the lACs. Accordingly, the above method can be implemented without needing to share or otherwise provide access to the users’ actual authentication credentials, thereby reducing the risk of compromising the users’ authentication credentials.Furthermore, the generation of the lACs is integrated it to a practical application because the lACs can be used by the intermediary server to validate client requests directed to the web server and thwart potential DDoS attacks.

[0027] The devices, systems, and methods disclosed herein can provide numerous technological benefits. For example, by instructing the intermediary server to validate subsequent client requests based on detecting a web traffic anomaly, and by receiving validated subsequent client requests, superfluous requests associated with DoS and DDoS attacks can be prevented from reaching the web server. Thus, the web server may avoid expending excessive computing resources that could otherwise be disabling if the superfluous requests continued to reach the web server. Accordingly, the devices, systems, and methods disclosed herein may be used to thwart potential DoS and DDoS attacks, thereby helping to ensure that the web server remains operational and is able to process legitimate client requests, and improving the functioning of the web server.

[0028] FIG. 1 illustrates a diagram of a web traffic system 100, according to at least one aspect of the present disclosure. The web traffic system 100 includes a client device 102 in communication with a web server 104. The web server 104 can receive a request from the client device 102, such as a request for a web page or another resource provided by the web server 104. Based on receiving the request, the web server 104 can provide the content of the web page or the requested resource to the client device 102. In some aspects, the communication between the client device 102 and the web server 104 utilizes a Hypertext Transfer Protocol (HTTP) or variants thereof (e.g., Hypertext Transfer Protocol Secure (HTTPS)). The client device 102 can be any type of device capable of communicating via the Internet, such as, for example, a personal computing device, a mobile computing device (e.g., laptop, smartphone), an Internet of things (loT) device (e.g., a smart home hub), a smart television, or any other type of device that may be used to access a resource of the web server 104.

[0029] The web traffic system 100 further includes an intermediary server 106. The intermediary server 106 can include one or more than one different types of intermediary servers. For example, the intermediary server 106 can include a first internet service provider (ISP) server 108, a second ISP server 110, and / or a proxy server 112. The first ISP server 108, the second ISP server 110, and / or the proxy server 112 can facilitate connection of the client device 102 to the Internet. Thus, the first ISP server 108, the second ISP server 110, and / or the proxy server 112 can facilitate communication between the client device 102 and the web server 104. In some aspects, the first ISP server 108 can correspond to a lower tier ISP (e.g., Tier 3, Tier 2) and the second ISP can correspond to a higher tier ISP (e.g., Tier 2, Tier 1). The proxy server 112 can be a gateway or intermediary for communication between the client device 102 and the web server 104. Although FIG. 1 depicts the intermediary server 106 as including the first ISP server 108, the second ISP server 110, and the proxy server 112, in other aspects, the intermediary server 106 can include less than two ISP servers (e.g., zero or one ISP servers), more than two ISP servers, more than one proxy server, or no proxy servers. Furthermore, in other aspects, the order of the connectivity between the servers included in the intermediary server 106 can be different from the example illustrated in FIG. 1.

[0030] In some aspects, the client device 102, the intermediary server 106, and / or the web server 104 can communicate via one or more wired and / or wireless networks. For example, the client device 102, the intermediary server 106, and / or the web server 104 can communicate via a cellular network (e.g., a long-term evolution (LTE) network, a fourth generation (4G) network, a fifth generation (5G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a local area network (LAN), awide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., the public switched telephone network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber optic-based network, a cloud computing network, and / or the like, and / or a combination of these or other types of networks.

[0031] FIG. 2A illustrates a diagram of a web traffic system 200a during a Distributed Denial of Service (DDoS) attack, according to at least one aspect of the present disclosure. The web traffic system 200a can be similar in many respects to the web traffic system 100 (FIG. 1), with corresponding reference numerals indicating the same or similar components. The web traffic system 200a includes multiple client devices 102 sending legitimate requests to the web server 104 via different intermediary servers 106. For example, as illustrated in FIG. 2A, the client device 102a is sending a request to the web server 104 via the intermediary server 106a and the client device 102b is sending a request to the web server 104 via the intermediary server 106b. Each of the intermediary servers 106a, 106b, 106c may include one or more than one different types of intermediary servers, such different tiers of ISP servers and / or proxy servers, as described above with respect to the intermediary server 106 of FIG. 1. The number of client devices 102 and intermediary servers 106 depicted in FIG. 2A are for illustrative purposes. The web traffic system 200a can include any number (e.g. thousands, millions) of client devices 102 sending requests to the web server 104 via any number (e.g., tens, thousands) of intermediary servers 106.

[0032] Referring still to FIG. 2A, web traffic system 200a also includes botnets 120a-e (sometimes collectively referred to as botnets 120) attempting to maliciously execute a DDoS attack on the web server 104. For example, as illustrated in FIG. 2A, the botnet 120a and the botnet 120b are sending superfluous requests to the web server 104 via the intermediary server 106a, the botnet 120c is sending superfluous requests to the web server 104 via the intermediary server 106b, and the botnet 120d and the botnet 120e are sending superfluous requests to the web server 104 via the intermediary server 106c. Each of the botnets 120 may be comprised of one or more than one Internet-connected device that has been compromised by malware programmed to cause the device to send the superfluous requests to the web server 104. The number of botnets 120 depicted in FIG. 2A is for illustrative purposes. The web traffic system 200a can include any number (e.g. thousands) of botnets 120. In some aspects, the botnets 120 are capable of sending over a million requests per second to the web server 104. The requests sent by the botnets 120 to the web server 104 may be sufficient to significantly slow or disable the web server 104 such that it is unable to process the legitimate requests sent by the client devices 102.

[0033] FIG. 2B illustrates a diagram of the web traffic system 200b employing a Distributed Defensive Architecture (DDA) to mitigate the DDoS attack described above withrespect to FIG. 2A, according to at least one aspect of the present disclosure. The web traffic system 200b is similar in many respects to the web traffic system 200a (FIG. 2A), except that the intermediary servers 106 are configured in a defense mode that causes the intermediary servers 106 to determine whether requests directed to the web server 104 are valid, forward validated requests to the web server 104, and refrain from forwarding requests that cannot be validated to the web server 104. For example, as illustrated by FIG. 2B, legitimate requests from the client device 102a and the client device 102b have been validated and forwarded to the web server 104 by the intermediary server 106a and the intermediary server 106b, respectively. Conversely, the intermediary servers 106 are unable to validate the superfluous requests from the corresponding botnets 120. Thus, the intermediary servers 106 do not forward the superfluous requests from the botnets 120 to the web server 104. Accordingly, the web server 104 is not flooded with the superfluous requests from the botnets 120 and is able to process the legitimate requests from the client devices 102.

[0034] In some aspects, the intermediary servers 106 receive an instruction from the web server 104 causing the intermediary to enter the defense mode based on the web server 104 detecting an anomaly related incoming web traffic (e.g., detecting an increase in the volume of incoming requests). In other aspects, one or more than one of the intermediary servers 106 may enter the defense mode based on the one or more than one of the intermediary servers 106 detecting an anomaly related incoming web traffic directed to the web server 104. The intermediary servers 106 may take this action automatically or based upon alerting the web server 104 of the detected anomaly and receiving a responsive instruction to enter the defense mode from the web server 104. In some aspects, one or more of the intermediary servers 106 may selectively enter the defense mode without other of the intermediary servers 106 entering the defense mode. For example, a web traffic anomaly that corresponds to traffic through only some of the intermediary servers 106 may be detected. Those intermediary servers 106 may selectively enter the defense mode while other intermediary servers 106 do not enter the defense mode. In some aspects, the intermediary servers 106 may enter the defense mode according to any of the methods 300, 500, 600 described herein with respect to FIGS. 3, 5, and 5, respectively.

[0035] In some aspects, the authentication credentials used for validation may be indirect authentication credentials (lACs) that are generated based on authentication credentials stored in an authentication credentials database associated with the web server 104. The lACs may be generated by salting and hashing the authentication credentials from the authentication credentials database. In some aspects, the generation of the lACs may be carried out according any of the methods 300, 500, 600 described herein with respect toFIGS. 3, 5, and 6, respectively. In some aspects, validation of incoming requests by the intermediary servers 106 may be carried out according any of the methods 400, 500, 600 described herein with respect to FIGS. 4, 5, and 6, respectively.

[0036] FIG. 3 is a flow diagram of a method 300 for initializing a DDA based on detecting a potential DDoS attack, which may be carried out by the web traffic system 100 of FIG. 1 and / or the web traffic system 200a / 200b of FIGS. 2A-2B, according to at least one aspect of the present disclosure. As will be apparent from the description below, the actions taken to carry out the method 300 may be implemented in any order. According to the method 300, the web server 104 generates 302 an indirect authentication credentials (IAC) database 116 based on an authentication credentials database 114. The authentication credentials database 114 may store authentication credentials (e.g., usernames, passwords, tokens) that are used to authenticate users requesting access for a web page and / or a resource provided by the web server 104. The IAC database 116 can store lACs generated 302 based on the authentication credentials from the authentication credentials database 114.

[0037] According to some aspects of the method 300, the IAC database 116 is generated 302 by salting and hashing the authentication credentials from the authentication credentials database 114. For example, the authentication credentials database 114 may store a username and a password for each of a plurality of registered user accounts. lACs may be generated for each of the accounts by applying a first salt (e.g., Saltl) and then a hash function (e.g., Hash) to the corresponding username to generate a salted and hashed username (e.g., Hash(Username + Saltl) = Salted and Hashed Username), and applying a second salt (e.g., Salt2) and the hash function to the corresponding password to generate a salted and hashed password (e.g., Hash(Password + Salt2) = Salted and Hashed Password). In some aspects, the first salt and the second salt may be the same. In other aspects, the first salt and the second salt may be different.

[0038] As another example, the authentication credentials database 114 may store a token for at least some of a plurality of registered accounts. The tokens may be stored in addition to or in lieu of a username and / or password. lACs may be generated for each of the accounts by applying a salt (e.g., Salt3) and then a hash function (e.g., Hash) to the corresponding token to generate a salted and hashed toke (e.g., Hash(Token + Salt3) = Salted and Hashed Token).

[0039] As used herein, “salting” or “applying a salt” can mean appending input data with a string of data (e.g., numbers, letters, characters, bits, etc.). The string of data appended to the input data may be referred to as a “salt.” The salt may be appended to specific positions of the input data, which may be designated by the salting function and / or salting algorithmused to apply the salt. For example, a salting function can be configured to append the character “%” after the first character of an input data string and append the character “$” after the fourth character of the input data string. Applying this example salting function to an input username “abcdefg” can generate the salted username “a%bcd$efg.”

[0040] As used herein, “hashing” or a “hash function” may refer to any algorithm or function that takes as input data and returns a fixed-size bit string (e.g., a hash).

[0041] According to some aspects of the method 300, the web server 104 may sometimes generate 302 a new I AC database 116. In one aspect, the web server 104 may generate 302 a new I AC database 116 on a periodic basis, such as, for example, once every hour, once every day, once every week, once every month, etc. In another aspect, the web server 104 may generate 302 a new I AC database 116 based on the occurrence of an event. For example, the web server 104 may generate 302 a new IAC database 116 based on detecting 306 an anomaly related to incoming web traffic and / or based on instructing 308 the intermediary server 106 to enter a defense mode. As another example, the web server 104 may generate 302 a new IAC database 116 any time new token(s) are issued. As noted above, the authentication credentials database 114 may store tokens that are associated with user accounts and are used to authenticate to the web server 104. New replacement tokens may be periodically generated, issued to the users and / or client devices associated with the users, and also stored in the authentication credentials database 114. A new IAC database 116 may be generated based on the generation, storage, and / or issuance of the new tokens.

[0042] In some aspects, each time a new IAC database 116 is generated, different salts may be applied. Thus, the lACs stored in each new IAC database 116 may be different from the lACs in the previously generated IAC database 116. Accordingly, generating 302 a new IAC database 116 on a periodic basis or based on the occurrence of an event can help to ensure the security of the underlying authentication credentials and / or help prevent malicious actors from compiling lACs that could be used in an attempt to send seemingly valid requests to the web server 104.

[0043] Referring still to FIG. 3, according to the method 300, the web server 104 shares 304 the IAC database 116 with the intermediary server 106. As described further herein with respect to FIG. 1, the intermediary server 106 can include multiple intermediary servers (e.g., a first ISP server 108, a second ISP server 110, a proxy server 112). As described further herein with respect to FIGS. 2A and 2B, multiple intermediary servers 106 may forward requests from client devices 102 to the web server 104. The intermediary server 106 shown in FIG. 3 can represent some or all of the servers that forward requests to the webserver 104. In some aspects, the web server 104 may selectively share 304 the I AC database 116 with one or more than one of the servers that may be included in the intermediary server 106. In other aspects, the web server 104 may share 304 the I AC database 116 with all of the servers that may be included in the intermediary server 106. In some aspects, sharing 304 the I AC database 116 with the intermediary server 106 can include allowing the intermediary server 106 to access the I AC database 116. In other aspects, sharing 304 the IAC database with the intermediary server can include sending data (e.g., lACs) comprised in the IAC database 116 to the intermediary server 106 for storage by the intermediary server 106.

[0044] According to some aspects of the method 300, the IAC database 116 is shared 304 with the intermediary server 106 based upon generation 302 of the IAC database 116. For example, every time a new IAC database 116 is generated 302, the web server 104 may share 304 the new IAC database with the intermediary server 106. As another example, the web server 104 may share 304 the IAC database 116 with the intermediary server 106 based on the occurrence of an event. For example, the web server 104 may pre-generate the IAC database 116 but wait to share 304 the IAC database 116 with the intermediary server 106 based on the occurrence an event, such as the detection 306 of an anomaly related to incoming web traffic and / or based on instructing 308 the intermediary server 106 enter a defense mode.

[0045] According to the method 300, the web server 104 detects 306 an anomaly related to web traffic (e.g., incoming requests) from the intermediary server 106. As noted above, the intermediary server 106 can represent one or more than one servers forwarding requests to the web server 104. In some aspects, the detected 306 anomaly may be based on web traffic from a single intermediary server 106. In other aspects, the detected 306 anomaly may be based on aggregated web traffic from multiple different intermediary servers 106. Based on detecting 306 the anomaly related to the web traffic from the intermediary server 106, the web server 104 can instruct 308 the intermediary server 106 to switch to (e.g., initiate, implement) a defense mode. Switching to the defense mode can cause the intermediary server 106 to determine whether subsequent requests directed to the web server 104 are valid, for example, based on the IAC credentials from the IAC database 116. According to some aspects, the intermediary server 106 can implement the defense mode according to the methods 400 and / or 600, as described with respect to FIGS. 4 and 6, respectively.

[0046] According to some aspects of the method 300, detecting 306 an anomaly related to the web traffic from the intermediary server 106 can include detecting an increase in the volume of requests being forwarded by the intermediary server 106 to the web server 104.For example, in some aspects, detecting 306 the anomaly may be based on the volume increase of the web traffic satisfying a predetermined threshold. A baseline and / or expected web traffic volume for a particular time of day, a particular day of the week, a particular time of the month, and / or a particular time of the year may be derived from historic web traffic data. The baseline and / or expected web traffic may vary periodically depending on the nature of the services and / or resources provided by the web server 104 (e.g., users may access a streaming service associated with the web server 104 at higher volumes during the evening, users may access an online store associated with the web server 104 during a particular season, etc.). Accordingly, a predetermined threshold used as the basis for detecting 306 an anomaly in web traffic can be, for example, a 50% increase, a 100% increase, a 150% increase, a 200% increase, a 500% increase, a 1000% increase, or a greater than 1000% increase in web traffic volume compared to a baseline and / or expected web traffic volume for a particular time period.

[0047] As another example, in some aspects, detecting 306 the anomaly may be based on a rate of the volume increase of the web traffic satisfying a predetermined threshold. Accordingly, a predetermined threshold used as the basis for detecting 306 an anomaly in web traffic can be, for example, a 50% increase, a 100% increase, a 150% increase, a 200% increase, a 500% increase, a 1000% increase, or a greater than 1000% increase in web traffic volume over a predetermined time period. The predetermined time period can be, for example, on the order of seconds (e.g., 1 second, 10 seconds, 30 sections), minutes (e.g., 1 minute, 10 minutes, 30 minutes), or hours.

[0048] According to other aspects of the method 300, detecting 306 an anomaly related to the web traffic can include detecting the anomaly via an anomaly detection system executed by the web server 104. The anomaly detection system can be configured to identify any type of unusual or unexpected characteristic of the web traffic being received by the web server 104. For example, the web server 104 may provide web pages, resources, and / or other features that are infrequently requested by client devices 102 and / or are expected to be requested by client devices 102 under particular circumstances. The anomaly detection system may identify the receipt of an unusual number of requests for these web pages, resources, and / or other features as an anomaly in the web traffic.

[0049] FIG. 4 is a flow diagram of a method 400 for executing a DDA to mitigate a potential DDoS attack, which may be carried out by the web traffic system 100 of FIG. 1 and / or the web traffic system 200a / 200b of FIGS. 2A-2B, according to at least one aspect of the present disclosure. According to some aspects of the method 400, the intermediary server 106 may be configured in a defense mode, for example, based on the detection 306 of an anomaly (FIG. 3). The intermediary server 106 receives 402 a request from a clientdevice 102 directed to the web server 104. The request received 402 by the intermediary server 106 can comprise an indirect authentication credential (IAC) sent from the client device, which is sometimes referred to herein as a client IAC. In some aspects, the request sent by the client device 102 may include a header and / or a code (e.g., an HTTP header) that comprises the client IAC. The client IAC may be generated based on an authentication credential received by the client device 102.

[0050] In some aspects, the client device 102 generates the client IAC from the authentication credentials based on a hidden field included in web page data sent to the client device 102 by the web server 104. The hidden field may cause the generation of the client IAC based on the same hash and salt functions that are used to generate the IAC database 116. For example, when a user of the client device 102 provides authentication credentials for accessing a resource of the web server 104, the hidden field can cause the authentication credentials to be salted and hashed to generate the client IAC. Accordingly, the client IAC included in the request received 402 by the intermediary server 106 can match a corresponding IAC included in the IAC database 116, which is sometimes referred to herein as a server IAC.

[0051] Referring still to FIG. 4, according to the method 400, the intermediary server 106 validates 404 the request received 402 from the client device 102 based on the IAC database 116. For example, to validate 404 the request, the intermediary server 106 can compare the client IAC included in the request received 402 from the client device 102 to the server lACs included in the IAC database 116. The intermediary server 106 can determine that the request from the client device 102 is valid by identifying a server IAC included in the IAC database 116 that matches the client IAC.

[0052] In some aspects, the intermediary server 106 may receive a request that does not include a client IAC or that includes an invalid IAC (e.g., a request from a botnet 120 executing a DDoS attack). The intermediary server 106 will therefore be unable to validate 404 the request.

[0053] Referring still to FIG. 4, according to the method, the intermediary server 106 forwards 406 the validated request to the web server 104. Accordingly, the web server 104 can process the request from the client device 102. However, the intermediary server may refrain from forwarding requests that are unable to be validated to the web server 104. Refraining from forwarding requests that are unable to be validated can prevent the web server 104 from being flooded with superfluous requests associated with a potential DoS or DDoS attack. Accordingly, in various aspects, the method 400 can be used to thwart potential DoS and DDoS attacks.

[0054] FIG. 5 is a flow diagram of a method 500 for protecting a web server from anomalous web traffic, according to at least one aspect of the present disclosure. The method 500 may be carried out by the web server 104 interacting with the intermediary server 106 described herein with respect to any of FIGS. 1-4. According to the method 500, the web server 104 receives 502 client requests via the intermediary server 106. Further, the web server 104 detects 504 an anomaly related to the client requests.

[0055] According to some aspects of the method 500, the web server 104 detects 504 the anomaly related to the client requests based on detecting an increase in a volume of the client requests. In other aspects, the web server 104 detects 504 the anomaly related to the client requests based on an anomaly detection system of the web server 104 analyzing the client requests.

[0056] Referring still to FIG. 5, according to the method 500, the web server 104 instructs 506 the intermediary server 106 to validate subsequent client requests. For example, the web server 104 can instruct 506 the intermediary server 106 to validate subsequent client requests based on detecting 504 the anomaly related to the client requests. Further, according to the method 500, the web server 104 receives 508 validated subsequent client requests from the intermediary server 106.

[0057] According to some aspects of the method 500, the web server 104 stores authentication credentials in first database. The web server 104 can generate server indirect authentication credentials (lACs) based on authentication credentials stored in the first database. Further, the web server 104 can store the server lACs in a second database. The subsequent client requests can comprise client lACs and the intermediary server 106 can validate the subsequent client requests based on comparing the client lACs to the server lACs.

[0058] According to some aspects of the method 500, each of the authentication credentials stored in the first database can comprise a username and a password. Further, the web server 104 can generate each of the server lACs by salting the username with a first salt to generate a salted username, salting the password with a second salt to generate a salted password, and hashing the salted username and salted password to respectively generate a hashed and salted username and a hashed and salted password.

[0059] According to some aspects of the method 500, the web server 104 can periodically generate updated server lACs. The web server 104 can generate each of the updated server lACs based on an updated first salt and an updated second salt. In one aspect, the web server 104 can periodically generate the updated server lACs at least once per day. In another aspect, the web server 104 can periodically generate the updated serverlACs each time the web server 104 detects 504 an anomaly related to the client requests.

[0060] According to some aspects of the method 500, the web server 104 detects that the anomaly no longer exists and instructs the intermediary server 106 to stop validating the subsequent client requests. In another aspects, the web server 104 instructs the intermediary server 106 to stop validating the subsequent client requests based on a timer or a predetermined time period after instructing 506 the intermediary server 106 to validate the subsequent client requests.

[0061] According to some aspects of the method 500, the intermediary server 106 comprises an ISP server (e.g., the first ISP server 108, the second ISP server 110 (FIG. 1)) or a proxy server (e.g., the proxy server 112) or a combination thereof.

[0062] According to some aspects of the method 500, the web server 104 may block subsequent client requests based on detecting the anomaly. For example, the web server 104 may block subsequent client requests for a predetermined period of time. According to other aspects of the method 500, the web server may drop web traffic associated with the client requests corresponding to the detected anomaly. For example, the web server 104 may forward the dropped web traffic to another server. Security personnel may analyze the dropped web traffic forwarded to the another server to determine a cause of the anomaly.

[0063] FIG. 6 is a flow diagram of a method 600 for protecting a web server from anomalous web traffic, according to at least one aspect of the present disclosure. The method 600 may be carried out by the intermediary server 106 interacting with the web server 104 described herein with respect to any of FIGS. 1-4. According to the method 600, the intermediary server 106 receives 602 client requests directed to a web server 104. The intermediary server 106 forwards 604 the client requests to the web server. The intermediary server receives 606 an instruction from the web server 104 to validate subsequent client requests. The instruction is based on an anomaly detected related to the client requests. According to some aspects of the method 600, the web server detects the anomaly related to the client requests. According to other aspects of the method 600, the intermediary server 106 detects the anomaly related to the client requests.

[0064] Referring still to FIG. 6, according to the method 600, the intermediary server 106 receives 608 the subsequent client requests and validates 610 the subsequent client requests. Further, the intermediary server 106 forwards 612 validated subsequent client requests to the web server 104.

[0065] According to some aspects method 600, the intermediary server 106 receives access to an indirect authentication credential (I AC) database (e.g., I AC database 116 of FIG. 3) associated with the web server 104. Further, the intermediary server 106 canvalidate 610 the subsequent client requests based on the IAC database.

[0066] According to some aspects method 600, the IAC database comprises server lACs. Further, at least some of the subsequent client requests received 608 by the intermediary server 106 comprise client lACs. The intermediary server can validate 610 the subsequent client requests based on the IAC database by comparing the client lACs to the server lACs.

[0067] According to some aspects of the method 600, at least some of the subsequent client requests do not comprise the client lACs. The intermediary server 106 can refrain from forwarding the at least some of the subsequent client requests that do not comprise the client IAC to the web server 104. For example, at least some of the subsequent client requests that do not comprise the client IAC are sent to the intermediary server 106 by a botnet. By refraining from forwarding the at least some of the subsequent client requests that do not comprise the client IAC to the web server 104, the intermediary server 106 may prevent the web server 104 from being flooded with requests from botnets that are attempting to execute a DDoS attack on the web server 104.

[0068] According to some aspects of the method 600, the intermediary server 106 comprises an ISP server. According to other aspects of the method 600, the intermediary server 106 comprises a proxy server.

[0069] FIG. 7 is a block diagram of a computer apparatus 3000 comprising data processing subsystems or components, according to at least one aspect of the present disclosure. The subsystems shown in FIG. 7 are interconnected via a system bus 3010. Additional subsystems such as a printer 3018, keyboard 3026, fixed disk 3028 (or other memory comprising computer readable media), monitor 3022, which is coupled to a display adapter 3020, and others are shown. Peripherals and input / output (I / O) devices, which couple to an I / O controller 3012 (which can be a processor or other suitable controller), can be connected to the computer system by any number of means known in the art, such as a serial port 3024. For example, the serial port 3024 or external interface 3030 can be used to connect the computer apparatus to a wide area network such as the Internet, a mouse input device, or a scanner. The interconnection via system bus allows the central processor 3016 to communicate with each subsystem and to control the execution of instructions from system memory 3014 or the fixed disk 3028, as well as the exchange of information between subsystems. The system memory 3014 and / or the fixed disk 3028 may embody a computer readable medium.

[0070] FIG. 8 is a diagrammatic representation of an example computing system 4000 that includes a host machine 4002 within which a set of instructions to generate any one ormore of the systems, models, and modules described herein and / or to perform any one or more of the methodologies described herein, according to at least one aspect of the present disclosure. In various aspects, the host machine 4002 operates as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, the host machine 4002 may operate in the capacity of a server or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The host machine 4002 may be a computer or computing device, a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a cellular telephone, a portable music player (e.g., a portable hard drive audio device such as an Moving Picture Experts Group Audio Layer 3 (MP3) player), a web appliance, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while only a single machine is illustrated, the term “machine” shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0071] The example system 4000 includes the host machine 4002, running a host operating system (OS) 4004 on a processor or multiple processor(s) / processor core(s) 4006 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both), and various memory nodes 4008. The host OS 4004 may include a hypervisor 4010 which is able to control the functions and / or communicate with a virtual machine (“VM”) 4012 running on machine readable media. The VM 4012 also may include a virtual CPU or vCPU 4014. The memory nodes 4008 may be linked or pinned to virtual memory nodes or vNodes 4016. When the memory node 4008 is linked or pinned to a corresponding vNode 4016, then data may be mapped directly from the memory nodes 4008 to the corresponding vNode 4016.

[0072] All the various components shown in host machine 4002 may be connected with and to each other, or communicate to each other via a bus (not shown) or via other coupling or communication channels or mechanisms. The host machine 4002 may further include a video display, audio device or other peripherals 4018 (e.g., a liquid crystal display (LCD), alpha-numeric input device(s) including, e.g., a keyboard, a cursor control device, e.g., a mouse, a voice recognition or biometric verification unit, an external drive, a signal generation device, e.g., a speaker,) a persistent storage device 4020 (also referred to as disk drive unit), and a network interface device 4022. The host machine 4002 may further include a data encryption module (not shown) to encrypt data. The components provided in the host machine 4002 are those typically found in computer systems that may be suitable for use with aspects of the present disclosure and are intended to represent a broad category of such computer components that are known in the art. Thus, the system 4000can be a server, minicomputer, mainframe computer, or any other computer system. The computer may also include different bus configurations, networked platforms, multiprocessor platforms, and the like. Various operating systems may be used including UNIX, LINUX, WINDOWS, QNX ANDROID, IOS, CHROME, TIZEN, and other suitable operating systems.

[0073] The disk drive unit 4024 also may be a Solid-state Drive (SSD), a hard disk drive (HDD) or other includes a computer or machine-readable medium on which is stored one or more sets of instructions and data structures (e.g., data / instructions 4026) embodying or utilizing any one or more of the methodologies or functions described herein. The data / instructions 4026 also may reside, completely or at least partially, within the main memory node 4008 and / or within the processor(s) 4006 during execution thereof by the host machine 4002. The data / instructions 4026 may further be transmitted or received over a network 4028 via the network interface device 4022 utilizing any one of several well-known transfer protocols (e.g., Hyper Text Transfer Protocol (HTTP)).

[0074] The processor(s) 4006 and memory nodes 4008 also may comprise machine- readable media. The term "computer-readable medium" or “machine-readable medium” should be taken to include a single medium or multiple medium (e.g., a centralized or distributed database and / or associated caches and servers) that store the one or more sets of instructions. The term "computer-readable medium" shall also be taken to include any medium that is capable of storing, encoding, or carrying a set of instructions for execution by the host machine 4002 and that causes the host machine 4002 to perform any one or more of the methodologies of the present application, or that is capable of storing, encoding, or carrying data structures utilized by or associated with such a set of instructions. The term ’’computer-readable medium” shall accordingly be taken to include, but not be limited to, solid-state memories, optical and magnetic media, and carrier wave signals. Such media may also include, without limitation, hard disks, floppy disks, flash memory cards, digital video disks, random access memory (RAM), read only memory (ROM), and the like. The example aspects described herein may be implemented in an operating environment comprising software installed on a computer, in hardware, or in a combination of software and hardware.

[0075] One skilled in the art will recognize that Internet service may be configured to provide Internet access to one or more computing devices that are coupled to the Internet service, and that the computing devices may include one or more processors, buses, memory devices, display devices, input / output devices, and the like. Furthermore, those skilled in the art may appreciate that the Internet service may be coupled to one or more databases, repositories, servers, and the like, which may be utilized to implement anyof the various aspects of the disclosure as described herein.

[0076] The computer program instructions also may be loaded onto a computer, a server, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0077] Suitable networks may include or interface with any one or more of, for instance, a local intranet, a PAN (Personal Area Network), a LAN (Local Area Network), a WAN (Wide Area Network), a MAN (Metropolitan Area Network), a virtual private network (VPN), a storage area network (SAN), a frame relay connection, an Advanced Intelligent Network (AIN) connection, a synchronous optical network (SONET) connection, a digital T1, T3, E1 or E3 line, Digital Data Service (DDS) connection, DSL (Digital Subscriber Line) connection, an Ethernet connection, an ISDN (Integrated Services Digital Network) line, a dial-up port such as a V.90, V.34 or V.34bis analog modem connection, a cable modem, an ATM (Asynchronous Transfer Mode) connection, or an FDDI (Fiber Distributed Data Interface) or CDDI (Copper Distributed Data Interface) connection. Furthermore, communications may also include links to any of a variety of wireless networks, including WAP (Wireless Application Protocol), GPRS (General Packet Radio Service), GSM (Global System for Mobile Communication), CDMA (Code Division Multiple Access) or TDMA (Time Division Multiple Access), cellular phone networks, GPS (Global Positioning System), CDPD (cellular digital packet data), RIM (Research in Motion, Limited) duplex paging network, Bluetooth radio, or an IEEE 802.11 -based radio frequency network. The network 4028 can further include or interface with any one or more of an RS-232 serial connection, an IEEE-1394 (Firewire) connection, a Fiber Channel connection, an IrDA (infrared) port, a SCSI (Small Computer Systems Interface) connection, a USB (Universal Serial Bus) connection or other wired or wireless, digital or analog interface or connection, mesh or Digi® networking.

[0078] In general, a cloud-based computing environment is a resource that typically combines the computational power of a large grouping of processors (such as within web servers) and / or that combines the storage capacity of a large grouping of computer memories or storage devices. Systems that provide cloud-based resources may be utilized exclusively by their owners or such systems may be accessible to outside users who deploy applications within the computing infrastructure to obtain the benefit of large computational or storage resources.

[0079] The cloud is formed, for example, by a network of web servers that comprise a plurality of computing devices, such as the host machine 4002, with each server 4030 (or at least a plurality thereof) providing processor and / or storage resources. These servers manage workloads provided by multiple users (e.g., cloud resource customers or other users). Typically, each user places workload demands upon the cloud that vary in real-time, sometimes dramatically. The nature and extent of these variations typically depends on the type of business associated with the user.

[0080] It is noteworthy that any hardware platform suitable for performing the processing described herein is suitable for use with the technology. The terms “computer-readable storage medium” and “computer-readable storage media” as used herein refer to any medium or media that participate in providing instructions to a CPU for execution. Such media can take many forms, including, but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media include, for example, optical or magnetic disks, such as a fixed disk. Volatile media include dynamic memory, such as system RAM. Transmission media include coaxial cables, copper wire and fiber optics, among others, including the wires that comprise one aspect of a bus. Transmission media can also take the form of acoustic or light waves, such as those generated during radio frequency (RF) and infrared (IR) data communications. Common forms of computer-readable media include, for example, a flexible disk, a hard disk, magnetic tape, any other magnetic medium, a CD-ROM disk, digital video disk (DVD), any other optical medium, any other physical medium with patterns of marks or holes, a RAM, a PROM, an EPROM, an EEPROM, a FLASH EPROM, any other memory chip or data exchange adapter, a carrier wave, or any other medium from which a computer can read.

[0081] Various forms of computer-readable media may be involved in carrying one or more sequences of one or more instructions to a CPU for execution. A bus carries the data to system RAM, from which a CPU retrieves and executes the instructions. The instructions received by system RAM can optionally be stored on a fixed disk either before or after execution by a CPU.

[0082] Computer program code for carrying out operations for aspects of the present technology may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++, or the like and conventional procedural programming languages, such as the "C" programming language, Go, Python, or other programming languages, including assembly languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remotecomputer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0083] Examples of the devices, systems, and methods according to various aspects of the present disclosure are provided below in the following numbered clauses. An aspect of any of the devices(s), method(s) and / or system(s) may include any one or more than one, and any combination of, the numbered clauses described below.

[0084] Clause 1: A computer-implemented method, comprising: receiving, by a web server, client requests via an intermediary server; detecting, by the web server, an anomaly related to the client requests; instructing, by the web server, the intermediary server to validate subsequent client requests; and receiving, by the web server, validated subsequent client requests from the intermediary server.

[0085] Clause 2: The computer-implemented method of Clause 1, further comprising: generating, by the web server, server indirect authentication credentials (lACs) based on authentication credentials stored in a first database; storing, by the web server, the server lACs in a second database; and sharing, by the web server, the second database with the intermediary server, wherein the subsequent client requests comprise client lACs, and wherein the intermediary server validates the subsequent client requests based on comparing the client lACs to the server lACs.

[0086] Clause 3: The computer-implemented method of Clause 2, wherein each of the authentication credentials stored in the first database comprises a username and a password, and wherein generating the server lACs comprises, for each of the authentication credentials stored in the first database: salting, by the web server, the username using a first salt to generate a salted username; salting, by the web server, the password using a second salt to generate a salted password; hashing, by the web server, the salted username to generate a hashed and salted username; and hashing, by the web server, the salted password to generate a hashed and salted password.

[0087] Clause 4: The computer-implemented method Clause 3, further comprising: periodically generating, by the web server, updated server lACs, wherein each of the updated server lACs is generated based on an updated first salt and an updated second salt.

[0088] Clause 5: The computer-implemented method of Clause 4, wherein periodically generating the updated server lACs comprises generating the updated server lACs at least once per day.

[0089] Clause 6: The computer-implemented method of Claim 4, wherein periodically generating the updated server lACs comprises generating the updated server lACs based on the web server detecting a new anomaly related to the client requests.

[0090] Clause 7: The computer-implemented method of any of Clauses 1-6, wherein detecting the anomaly related to the client requests comprises detecting, by the web server, an increase in a volume of the client requests.

[0091] Clause 8: The computer-implemented method of any of Clauses 1-7, wherein detecting the anomaly related to the client requests comprises analyzing, by an anomaly detection system of the web server, the client requests.

[0092] Clause 9: The computer-implemented method of any of Clauses 1-8, further comprising: detecting, by the web server, that the anomaly no longer exists; and instructing, by the web server, the intermediary server to stop validating the subsequent client requests.

[0093] Clause 10: The computer-implemented method of any of Clauses 1-9, wherein the intermediary server comprises an internet service provider server or a proxy server or a combination thereof.

[0094] Clause 11 : A computer-implemented method, comprising: receiving, by an intermediary server, client requests directed to a web server; forwarding, by the intermediary server, the client requests to the web server; receiving, by the intermediary server, an instruction from the web server to validate subsequent client requests, wherein the instruction is based on an anomaly detected related to the client requests; receiving, by the intermediary server, the subsequent client requests; validating, by the intermediary server, the subsequent client requests; and forwarding, by the intermediary server, validated subsequent client requests to the web server.

[0095] Clause 12: The computer-implemented method of Clause 11 , further comprising: receiving, by the intermediary server, access to an indirect authentication credential (IAC) database associated with the web server, and wherein the intermediary server validates the subsequent client requests based on the IAC database.

[0096] Clause 13: The computer-implemented method of Clause 12, wherein the IAC database comprises server lACs, wherein at least some of the subsequent client requests comprise client lACs, wherein the intermediary server validates the subsequent client requests based on comparing the client lACs to the server lACs, and wherein the validated subsequent client requests correspond to the at least some the subsequent client requests that comprise the client lACs.

[0097] Clause 14: The computer-implemented method of Clause 13, wherein at leastsome of the subsequent client requests do not comprise the client lACs, the method further comprising refraining, by the intermediary server, from forwarding the at least some of the subsequent client requests that do not comprise the client lACs to the web server.

[0098] Clause 15: The computer-implemented method of Clause 14, wherein the at least some of the subsequent client requests that do not comprise the client IAC are sent to the intermediary server by a botnet.

[0099] Clause 16: The computer-implemented method of any of Clauses 11-5, wherein the intermediary server comprises an internet server provider server or a proxy server or a combination thereof.

[0100] Clause 17: A web server, comprising: a processor; and a memory comprising instructions executable by the processor to cause the processor to: generate indirect authentication credentials (lACs) based on authentication credentials associated with user accounts; share the lACs with an intermediary server, wherein the intermediary server comprises an internet server provider server or a proxy server; detect an anomaly based on web traffic directed to the web server; instruct the intermediary server to validate subsequent web traffic directed to the web server based on the lACs; and receive validated web traffic directed to the web server via the intermediary server.

[0101] Clause 18: The web server of Clause 17, wherein the instructions to cause the processor to detect the anomaly based on the web traffic directed to the web server comprise instructions to detect the anomaly based on an increase in a volume of the web traffic directed to the web server.

[0102] Clause 19: The web server of any of Clauses 17-18, wherein the memory further comprises instructions to cause the processor to drop the web traffic directed to the web server based on detecting the anomaly and forward the dropped web traffic to another server to determine a cause of the detected anomaly.

[0103] Clause 20: The web server of any of Clause 17-19, wherein the authentication credentials associated with the user accounts comprise tokens, wherein the instructions to cause the processor to generate the lACs based on the authentication credentials associated with the user accounts comprise instructions to salt the tokens, wherein the validated web traffic comprises requests sent by user devices, and wherein the requests comprise the lACs.

[0104] Further, it is understood that any one or more of the following-described forms, expressions of forms, examples, can be combined with any one or more of the other following-described forms, expressions of forms, and examples.

[0105] While several forms have been illustrated and described, it is not the intention of Applicant to restrict or limit the scope of the appended claims to such detail. Numerous modifications, variations, changes, substitutions, combinations, and equivalents to those forms may be implemented and will occur to those skilled in the art without departing from the scope of the present disclosure. Moreover, the structure of each element associated with the described forms can be alternatively described as a means for providing the function performed by the element. Also, where materials are disclosed for certain components, other materials may be used. It is therefore to be understood that the foregoing description and the appended claims are intended to cover all such modifications, combinations, and variations as falling within the scope of the disclosed forms. The appended claims are intended to cover all such modifications, variations, changes, substitutions, modifications, and equivalents.

[0106] As used herein, a “server” may include one or more computing devices which can be individual, stand-alone machines located at the same or different locations, may be owned or operated by the same or different entities, and may further be one or more clusters of distributed computers or “virtual” machines housed within a datacenter. It should be understood and appreciated by a person of skill in the art that functions performed by one “server” can be spread across multiple disparate computing devices for various reasons. As used herein, a “server” is intended to refer to all such scenarios and should not be construed or limited to one specific configuration. Further, a server as described herein may, but need not, reside at (or be operated by) a merchant, a payment network, a financial institution, a healthcare provider, a social media provider, a government agency, or agents of any of the aforementioned entities. The term “server” may also refer to or include one or more processors or computers, storage devices, or similar computer arrangements that are operated by or facilitate communication and processing for multiple parties in a network environment, such as the Internet, although it will be appreciated that communication may be facilitated over one or more public or private network environments and that various other arrangements are possible. Further, multiple computers, e.g., servers, or other computerized devices, e.g., point-of-sale devices, directly or indirectly communicating in the network environment may constitute a “system,” such as a merchant's point-of-sale system.Reference to “a server” or “a processor,” as used herein, may refer to a previously recited server and / or processor that is recited as performing a previous step or function, a different server and / or processor, and / or a combination of servers and / or processors. For example, as used in the specification and the claims, a first server and / or a first processor that is recited as performing a first step or function may refer to the same or different server and / or a processor recited as performing a second step or function.

[0107] The term “system” may refer to one or more computing devices or combinations of computing devices (e.g., processors, servers, client devices, software applications, modules, components of such, and / or the like). For example, a system may include a plurality of computing devices that include software applications, where the plurality of computing devices are connected via a network.

[0108] As used herein, a “server computer” may describe a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers functioning as a unit. The server computer may be associated with an entity such as a payment processing network, a wallet provider, a merchant, an authentication cloud, an acquirer or an issuer. In one example, the server computer may be a database server coupled to a Web server. The server computer may be coupled to a database and may include any hardware, software, other logic, or combination of the preceding for servicing the requests from one or more client computers. The server computer may comprise one or more computational apparatuses and may use any of a variety of computing structures, arrangements, and compilations for servicing the requests from one or more client computers. In some embodiments or aspects, the server computer may provide and / or support payment network cloud service.

[0109] Reference to “a device,” “a server,” “a processor,” and / or the like, as used herein, may refer to a previously recited device, server, or processor that is recited as performing a previous step or function, a different server or processor, and / or a combination of servers and / or processors. For example, as used in the specification and the claims, a first server or a first processor that is recited as performing a first step or a first function may refer to the same or different server or the same or different processor recited as performing a second step or a second function.

[0110] One or more components may be referred to herein as “configured to,” “configurable to,” “operable / operative to,” “adapted / adaptable,” “able to,” “conformable / conformed to,” etc. Those skilled in the art will recognize that “configured to” can generally encompass active-state components and / or inactive-state components and / or standby-state components, unless context requires otherwise.

[0111] Those skilled in the art will recognize that, in general, terms used herein, and especially in the appended claims (e.g., bodies of the appended claims) are generally intended as “open” terms (e.g., the term “including” should be interpreted as “including but not limited to,” the term “having” should be interpreted as “having at least,” the term “includes” should be interpreted as “includes but is not limited to,” etc.). It will be further understood by those within the art that if a specific number of an introduced claim recitationis intended, such an intent will be explicitly recited in the claim, and in the absence of such recitation no such intent is present. For example, as an aid to understanding, the following appended claims may contain usage of the introductory phrases “at least one” and “one or more” to introduce claim recitations. However, the use of such phrases should not be construed to imply that the introduction of a claim recitation by the indefinite articles “a” or “an” limits any particular claim containing such introduced claim recitation to claims containing only one such recitation, even when the same claim includes the introductory phrases “one or more” or “at least one” and indefinite articles such as “a” or “an” (e.g., “a” and / or “an” should typically be interpreted to mean “at least one” or “one or more”); the same holds true for the use of definite articles used to introduce claim recitations.

[0112] The term “substantially”, “about”, or “approximately” as used in the present disclosure, unless otherwise specified, means an acceptable error for a particular value as determined by one of ordinary skill in the art, which depends in part on how the value is measured or determined. In certain aspects, the term “substantially”, “about”, or “approximately” means within 1, 2, 3, or 4 standard deviations. In certain aspects, the term “substantially”, “about”, or “approximately” means within 50%, 20%, 15%, 10%, 9%, 8%, 7%, 6%, 5%, 4%, 3%, 2%, 1%, 0.5%, or 0.05% of a given value or range.

[0113] In addition, even if a specific number of an introduced claim recitation is explicitly recited, those skilled in the art will recognize that such recitation should typically be interpreted to mean at least the recited number (e.g., the bare recitation of “two recitations,” without other modifiers, typically means at least two recitations, or two or more recitations). Furthermore, in those instances where a convention analogous to “at least one of A, B, and C, etc.” is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., “a system having at least one of A, B, and C” would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and / or A, B, and C together, etc.). In those instances where a convention analogous to “at least one of A, B, or C, etc.” is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., “a system having at least one of A, B, or C” would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and / or A, B, and C together, etc.). It will be further understood by those within the art that typically a disjunctive word and / or phrase presenting two or more alternative terms, whether in the description, claims, or drawings, should be understood to contemplate the possibilities of including one of the terms, either of the terms, or both terms unless context dictates otherwise. For example, the phrase “A or B” will be typically understood to include the possibilities of “A” or “B” or “A and B.”

[0114] With respect to the appended claims, those skilled in the art will appreciate that recited operations therein may generally be performed in any order. Also, although various operational flow diagrams are presented in a sequence(s), it should be understood that the various operations may be performed in other orders than those which are illustrated, or may be performed concurrently. Examples of such alternate orderings may include overlapping, interleaved, interrupted, reordered, incremental, preparatory, supplemental, simultaneous, reverse, or other variant orderings, unless context dictates otherwise. Furthermore, terms like “responsive to,” “related to,” or other past-tense adjectives are generally not intended to exclude such variants, unless context dictates otherwise.

[0115] It is worthy to note that any reference to “one aspect,” “an aspect,” “an exemplification,” “one exemplification,” and the like means that a particular feature, structure, or characteristic described in connection with the aspect is included in at least one aspect. Thus, appearances of the phrases “in one aspect,” “in an aspect,” “in an exemplification,” and “in one exemplification” in various places throughout the specification are not necessarily all referring to the same aspect. Furthermore, the particular features, structures or characteristics may be combined in any suitable manner in one or more aspects.

[0116] As used herein, the singular form of “a”, “an”, and “the” include the plural references unless the context clearly dictates otherwise.

[0117] Any patent application, patent, non-patent publication, or other disclosure material referred to in this specification and / or listed in any Application Data Sheet is incorporated by reference herein, to the extent that the incorporated materials is not inconsistent herewith. As such, and to the extent necessary, the disclosure as explicitly set forth herein supersedes any conflicting material incorporated herein by reference. Any material, or portion thereof, that is said to be incorporated by reference herein, but which conflicts with existing definitions, statements, or other disclosure material set forth herein will only be incorporated to the extent that no conflict arises between that incorporated material and the existing disclosure material.In summary, numerous benefits have been described which result from employing the concepts described herein. The foregoing description of the one or more forms has been presented for purposes of illustration and description. It is not intended to be exhaustive or limiting to the precise form disclosed. Modifications or variations are possible in light of the above teachings. The one or more forms were chosen and described in order to illustrate principles and practical application to thereby enable one of ordinary skill in the art to utilize the various forms and with various modifications as are suited to the particular use contemplated. It is intended that the claims submitted herewith define the overall scope.

Claims

CLAIMSWhat is claimed is:

1. A computer-implemented method, comprising: receiving, by a web server, client requests via an intermediary server; detecting, by the web server, an anomaly related to the client requests; instructing, by the web server, the intermediary server to validate subsequent client requests; and receiving, by the web server, validated subsequent client requests from the intermediary server.

2. The computer-implemented method of Claim 1, further comprising: generating, by the web server, server indirect authentication credentials (lACs) based on authentication credentials stored in a first database; storing, by the web server, the server lACs in a second database; and sharing, by the web server, the second database with the intermediary server, wherein the subsequent client requests comprise client lACs, and wherein the intermediary server validates the subsequent client requests based on comparing the client lACs to the server lACs.

3. The computer-implemented method of Claim 2, wherein each of the authentication credentials stored in the first database comprises a username and a password, and wherein generating the server lACs comprises, for each of the authentication credentials stored in the first database: salting, by the web server, the username using a first salt to generate a salted username; salting, by the web server, the password using a second salt to generate a salted password; hashing, by the web server, the salted username to generate a hashed and salted username; and hashing, by the web server, the salted password to generate a hashed and salted password.

4. The computer-implemented method of Claim 3, further comprising: periodically generating, by the web server, updated server lACs, wherein each of the updated server lACs is generated based on an updated first salt and an updated second salt.

5. The computer-implemented method of Claim 4, wherein periodically generating the updated server lACs comprises generating the updated server lACs at least once per day.

6. The computer-implemented method of Claim 4, wherein periodically generating the updated server lACs comprises generating the updated server lACs based on the web server detecting a new anomaly related to the client requests.

7. The computer-implemented method of Claim 1, wherein detecting the anomaly related to the client requests comprises detecting, by the web server, an increase in a volume of the client requests.

8. The computer-implemented method of Claim 1, wherein detecting the anomaly related to the client requests comprises analyzing, by an anomaly detection system of the web server, the client requests.

9. The computer-implemented method of Claim 1, further comprising: detecting, by the web server, that the anomaly no longer exists; and instructing, by the web server, the intermediary server to stop validating the subsequent client requests.

10. The computer-implemented method of Claim 1, wherein the intermediary server comprises an internet service provider server or a proxy server or a combination thereof.

11. A computer-implemented method, comprising: receiving, by an intermediary server, client requests directed to a web server; forwarding, by the intermediary server, the client requests to the web server; receiving, by the intermediary server, an instruction from the web server to validate subsequent client requests, wherein the instruction is based on an anomaly detected related to the client requests; receiving, by the intermediary server, the subsequent client requests; validating, by the intermediary server, the subsequent client requests; and forwarding, by the intermediary server, validated subsequent client requests to the web server.

12. The computer-implemented method of Claim 11, further comprising: receiving, by the intermediary server, access to an indirect authentication credential(IAC) database associated with the web server, and wherein the intermediary server validates the subsequent client requests based on the IAC database.

13. The computer-implemented method of Claim 12, wherein the IAC database comprises server lACs, wherein at least some of the subsequent client requests comprise client lACs, wherein the intermediary server validates the subsequent client requests based on comparing the client lACs to the server lACs, and wherein the validated subsequent client requests correspond to the at least some the subsequent client requests that comprise the client lACs.

14. The computer-implemented method of Claim 13, wherein at least some of the subsequent client requests do not comprise the client lACs, the method further comprising refraining, by the intermediary server, from forwarding the at least some of the subsequent client requests that do not comprise the client lACs to the web server.

15. The computer-implemented method of Claim 14, wherein the at least some of the subsequent client requests that do not comprise the client IAC are sent to the intermediary server by a botnet.

16. The computer-implemented method of Claim 11 , wherein the intermediary server comprises an internet server provider server or a proxy server or a combination thereof.

17. A web server, comprising: a processor; and a memory comprising instructions executable by the processor to cause the processor to: generate indirect authentication credentials (lACs) based on authentication credentials associated with user accounts; share the lACs with an intermediary server, wherein the intermediary server comprises an internet server provider server or a proxy server; detect an anomaly based on web traffic directed to the web server; instruct the intermediary server to validate subsequent web traffic directed to the web server based on the lACs; and receive validated web traffic directed to the web server via the intermediary server.

18. The web server of Claim 17, wherein the instructions to cause the processor todetect the anomaly based on the web traffic directed to the web server comprise instructions to detect the anomaly based on an increase in a volume of the web traffic directed to the web server.

19. The web server of Claim 17, wherein the memory further comprises instructions to cause the processor to drop the web traffic directed to the web server based on detecting the anomaly and forward the dropped web traffic to another server to determine a cause of the detected anomaly.

20. The web server of Claim 17, wherein the authentication credentials associated with the user accounts comprise tokens, wherein the instructions to cause the processor to generate the lACs based on the authentication credentials associated with the user accounts comprise instructions to salt the tokens, wherein the validated web traffic comprises requests sent by user devices, and wherein the requests comprise the lACs.

Images