Method and system for abnormal attack rate control

Abstract

In one embodiment, a method for controlling a simulated attack performed by an attack simulation node towards a production target and / or production network includes monitoring the simulated attack being performed by the attack simulation node, determining whether the simulated attack exceeds a predetermined threshold, and performing an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

Description

[0001] METHOD AND SYSTEM FOR ABNORMAL ATTACK RATE CONTROL

[0002] RELATED APPLICATION INFORMATION

[0003] The present application claims benefit of US Provisional Patent Application S / N 63 / 588,008 of Andriani, entitled “Method and system for abnormal rate cut-off”, filed 5 October 2023, the disclosure of which is hereby incorporated herein by reference.

[0004] FIELD OF THE DISCLOSURE

[0005] The present disclosure relates to computer systems, and in particular, but not exclusively to, security in computer systems.

[0006] BACKGROUND

[0007] Distributed denial of service (DDoS) attacks are cyber-attacks originating from public networks such as the Internet, and are a major threat to financial institutions (e.g., banks, Forex trading, stock exchanges), large e- commerce sites (auctions, gaming, retail, travel, gambling), hospitals, cloud infrastructure, governmental sites, ISP infrastructure, national infrastructure, and other organizations. Such attacks can bring down servers or services, prevent communications, stop business continuity, or otherwise damage enterprise networks such as those of stock exchanges, banks, governments, voting sites, insurance companies, NGOs (non-governmental organizations), as well as other critical online infrastructure. Despite increases in DDoS protection, most organizations, including the aforementioned entities and organizations, remain highly vulnerable to such cyber-attacks and lack little if any knowledge of the extent of their vulnerability to such cyber- attacks.

[0008] To determine vulnerabilities of a target and / or service to DDoS, it has been necessary to launch one or more DDoS attacks in a maintenance window and observe the effects of the DDoS attack(s). This method has drawbacks. First, the system under investigation needs to be down (i.e., not in production mode). Second, the number of test attacks which may be launched in a maintenance window is extremely limited. Third, maintenance windows can only generally be scheduled occasionally due to operational factors.

[0009] One solution to determine vulnerabilities of a target or service to DDoS is to evaluate the target or service in production mode (without having to use a maintenance window) using a Non-Disruptive DDoS vulnerability system commercially available from MazeBolt Technologies Ltd. and described in US Patent 10,509,909 entitled “Non-Disruptive DDoS Testing” and PCT Publication WO 2023 / 057950, entitled “Non-disruptive diagnostic and attack testing methods and systems”, filed on Oct. 6, 2022, both of the disclosures of which are incorporated herein by reference in their entirety. These methods may be used to provide Non-Disruptive DDoS testing data or other perimeter security testing data, which indicate for targets and / or services in a given environment, whether the targets and / or services are vulnerable (or how vulnerable) to given DDoS attacks (e.g., attack vectors) or other cyber-attacks.

[0010] SUMMARY

[0011] There is provided in accordance with an embodiment of the present disclosure, a method for controlling a simulated attack performed by an attack simulation node towards a production target and / or production network, the method including monitoring the simulated attack being performed by the attack simulation node, determining whether the simulated attack exceeds a predetermined threshold, and performing an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

[0012] Further in accordance with an embodiment of the present disclosure the threshold is any one of the following a fixed threshold, a dynamic threshold, or a threshold computed from environmental statistics.

[0013] Still further in accordance with an embodiment of the present disclosure the performing the action includes adjusting, or limiting, or terminating the simulated attack in response to the simulated attack exceeding the predetermined threshold.

[0014] Additionally in accordance with an embodiment of the present disclosure the simulated attack is a non-disruptive Distributed denial of service (DDoS) attack.

[0015] Moreover, in accordance with an embodiment of the present disclosure the monitoring, the determining, and the performing an action is performed by the attack simulation node.

[0016] Further in accordance with an embodiment of the present disclosure the monitoring includes monitoring a rate of the simulated attack being performed by the attack simulation node, the determining includes determining whether the rate of the simulated attack exceeds the predetermined threshold, and the method further includes terminating the simulated attack, or adjusting or limiting the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0017] Still further in accordance with an embodiment of the present disclosure, the method includes configuring network interface controller hardware to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0018] Additionally in accordance with an embodiment of the present disclosure, the method includes executing operating system software to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0019] Moreover, in accordance with an embodiment of the present disclosure the determining includes determining whether the rate of the simulated attack is lower than the predetermined threshold, and the terminating includes terminating the simulated attack, or increasing the rate of the simulated attack in response to the rate of the simulated attack being lower than the predetermined threshold.

[0020] Further in accordance with an embodiment of the present disclosure the determining includes determining whether the rate of the simulated attack is higher than the predetermined threshold, and the terminating includes terminating the simulated attack, or limiting or decreasing the rate of the simulated attack in response to the rate of the simulated attack being higher than the predetermined threshold.

[0021] Still further in accordance with an embodiment of the present disclosure the rate of the simulated attack is defined by one or more of the following connections per second (CPS), packets per second (PPS), kilobits per second (Kbps), or requests per second (RPS).

[0022] Additionally in accordance with an embodiment of the present disclosure the determining includes determining whether the rate of the simulated attack exceeds the predetermined threshold for a predetermined time period, and the method further including terminating the simulated attack, or adjusting or limiting the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold for the predetermined time period.

[0023] Moreover, in accordance with an embodiment of the present disclosure, the method includes notifying at least one other attack simulation node and / or a management node to adjust, limit or terminate the simulated attack. Further in accordance with an embodiment of the present disclosure, the method includes notifying at least one other attack simulation node and / or a management node of node statistics.

[0024] There is also provided in accordance with another embodiment of the present disclosure, a device for controlling a simulated attack performed by an attack simulation node towards a production target and / or production network, the device including processing circuitry configured to monitor the simulated attack being performed by the attack simulation node, determine whether the simulated attack exceeds a predetermined threshold, and perform an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold, and a memory configured to store data used by the processing circuitry.

[0025] Still further in accordance with an embodiment of the present disclosure the threshold is any one of the following a fixed threshold, a dynamic threshold, or a threshold computed from environmental statistics.

[0026] Additionally in accordance with an embodiment of the present disclosure the processing circuitry is configured to adjust, or limit, or terminate the simulated attack in response to the simulated attack exceeding the predetermined threshold.

[0027] Moreover, in accordance with an embodiment of the present disclosure the simulated attack is a non-disruptive Distributed denial of service (DDoS) attack.

[0028] Further in accordance with an embodiment of the present disclosure the device includes the attack simulation node, which includes the processing circuitry configured to simulate the attack towards the production target and / or the production network, monitor the simulated attack, determine whether the simulated attack exceeds the predetermined threshold, and perform the action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

[0029] Still further in accordance with an embodiment of the present disclosure the processing circuitry is configured to monitor a rate of the simulated attack being performed by the attack simulation node, determine whether the rate of the simulated attack exceeds the predetermined threshold, and terminate the simulated attack, or adjust or limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0030] Additionally in accordance with an embodiment of the present disclosure the processing circuitry is configured to configure network interface controller hardware to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0031] Moreover, in accordance with an embodiment of the present disclosure the processing circuitry is configured to execute operating system software to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0032] Further in accordance with an embodiment of the present disclosure the processing circuitry is configured to determine whether the rate of the simulated attack is lower than the predetermined threshold, and terminate the simulated attack, or increase the rate of the simulated attack in response to the rate of the simulated attack being lower than the predetermined threshold.

[0033] Still further in accordance with an embodiment of the present disclosure the processing circuitry is configured to determine whether the rate of the simulated attack is higher than the predetermined threshold, and terminate the simulated attack, or limit or decrease the rate of the simulated attack in response to the rate of the simulated attack being higher than the predetermined threshold.

[0034] Additionally in accordance with an embodiment of the present disclosure the rate of the simulated attack is defined by one or more of the following connections per second (CPS), packets per second (PPS), kilobits per second (Kbps), or requests per second (RPS).

[0035] Moreover, in accordance with an embodiment of the present disclosure the processing circuitry is configured to determine whether the rate of the simulated attack exceeds the predetermined threshold for a predetermined time period, and terminate the simulated attack, or adjust or limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold for the predetermined time period. Further in accordance with an embodiment of the present disclosure the processing circuitry is configured to notify at least one other attack simulation node and / or a management node to adjust, limit, inform of node statistics or terminate the simulated attack. Still further in accordance with an embodiment of the present disclosure the processing circuitry is configured to notify at least one other attack simulation node and / or a management node of node statistics.

[0036] There is also provided in accordance with still another embodiment of the present disclosure, a software product, including a non-transient computer- readable medium in which program instructions are stored, which instructions, when read by a central processing unit (CPU), cause the CPU to monitor a simulated attack performed by an attack simulation node towards a production target and / or production network, determine whether the simulated attack exceeds a predetermined threshold, and perform an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

[0037] BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The present disclosure will be understood from the following detailed description, taken in conjunction with the drawings in which:

[0039] Fig. 1 is a block diagram view of an attack simulation system constructed and operative in accordance with an embodiment of the present disclosure;

[0040] Fig. 2 is a flowchart including steps in a method of operation of the system of Fig. 1;

[0041] Fig. 3 is a flowchart including steps in a method to monitor for a minimum attack rate in the system of Fig. 1; and

[0042] Fig. 4 is a flowchart including steps in a method to monitor for a maximum attack rate in the system of Fig. 1.

[0043] DESCRIPTION OF EXAMPLE EMBODIMENTS

[0044] OVERVIEW

[0045] An attack simulation system may include attacker nodes to simulate attacks on production targets or networks, and monitoring nodes to monitor the level of the attacks on the targets, e.g., by sending messages to the targets or networks and measuring the response time. If the response time exceeds a limit, the attacks are terminated because it is desired that the targets or networks do not crash.

[0046] An attacker node may attack at a rate that is too high and may lead to a problem with one or more of the targets or networks, and it is desired to prevent this from happening. If the rate is too low, it may also be problematic as the targets or networks are being attacked for no practical reason and the simulated attack may not provide useful data.

[0047] Therefore, embodiments of the present disclosure address at least some of the above drawbacks by monitoring an attack simulation node which is attacking one or more productions targets or networks to ensure that rate of the simulated attack does not exceed a threshold. The term “exceeds a threshold”, in all its grammatical forms, includes (a rate of) the simulated attack increasing above a first threshold and / or (a rate of) the simulated attack decreasing below a second threshold. In some embodiments, if the rate of the simulated attack is determined to be higher (e.g., 30% higher or any suitable value) than a predetermined threshold (and optionally for a predetermined time period), the simulated attack may be terminated by the attack simulation node, or the rate of the attack may be reduced or limited by the attack simulation node, e.g., using a software and / or hardware mechanism, thereby ensuring uninterrupted service availability of the production target(s) / network(s) and prior to any unexpected behavior or damage to the target(s) / network(s) being validated. In some embodiments, if the rate of the simulated attack is determined to be lower (e.g., 30% lower or any suitable value) than a predetermined threshold (and optionally for a predetermined time period), the simulated attack may be terminated by the attack simulation node, or the rate of the attack may be increased by the attack simulation node. In some embodiments, the actual attack rate may be identified by monitoring the rate of attack in software or based on network card statistics, for example. In some embodiments, monitoring of the attack simulation node is performed by the attack simulation node. Additionally, or alternatively, monitoring of the attack simulation node may be performed by a management node, described in disclosed embodiments.

[0048] The threshold(s) may be fixed, dynamic and / or computed based on statistics derived from the system. In some embodiments, the rate threshold may be defined by a desired attack rate multiplied by a tolerance factor (e.g., 0.7 (for the lower threshold) and 1.3 (for the higher threshold) or any suitable values). The rate of the simulated attack may be defined by one or more of the following: connections per second (CPS); packets per second (PPS); kilobits per second (Kbps); or requests per second (RPS). By utilizing the disclosed method, users can set specific parameters to determine the anticipated rate of attack in terms of CPS, PPS, Kbps, or RPS. Additionally, the system may derive one or more of the specific parameters through other system functionality dynamically. The desired attack specified tolerance duration can also be set within the system or dynamically derived by the system.

[0049] In some embodiments, a fixed rate upper limit may be temporarily or permanently applied to the simulated attack by a network interface card (NIC) of the attack simulation node. The rate limit may use Kbps, CPS, or PPS as the metric of rate limiting while the simulated attack is running.

[0050] In some embodiments, the attack simulation node and / or the management node may notify one or more other attack simulation nodes to change their attack rate or to terminate the simulated attack.

[0051] The above monitoring and attack termination / adjusting method and system may be used with any suitable type of simulated attack. In some embodiments, the above monitoring and attack termination / adjusting method may be used with a Non-Disruptive DDoS vulnerability system commercially available from MazeBolt Technologies Ltd. and described in US Patent 10,509,909 entitled “Non-Disruptive DDoS Testing” and PCT Publication WO 2023 / 057950, entitled “Non-disruptive diagnostic and attack testing methods and systems”, filed on Oct. 6, 2022, for example, to protect the target(s) and / or their services from potential downtime or maintain simulation data integrity during a simulation of any suitable type of non-disruptive testing.

[0052] The abnormal rate cut-off or adjustment method does not rely on response monitoring of the production target(s) / network(s), but rather detects an abnormality in the expected attacking rate of the attack simulation node and prevents the attack simulation node from adversely affecting the test target(s) / network(s) or the results themselves.

[0053] TERMINOLOGY

[0054] Reference to the following terminology is made in the specification and claims in various grammatical forms.

[0055] “CPS” is measured by the number of network connections the attack simulation node has open to perform the simulated attack.

[0056] “PPS” is measured by the number of packets per second that the attack simulation node is sending to the production target(s) and / or production network(s) as part of the simulated attack.

[0057] “Kbps” is measured by the number of kilobits of data being sent by the attack simulation per second to the production target(s) and / or production network(s) as part of the simulated attack.

[0058] “RPS” is measured by the number of requests being sent per second by the attack simulation node to the production target(s) and / or production network(s) as part of the simulated attack.

[0059] “Incoming traffic” is attack-simulation traffic measured by a coordination device or agent in the target network. The coordination agent or device may identify incoming attack simulation traffic in the event that traffic bypasses the relevant defenses. “Outgoing traffic” is attack- traffic from the attack simulation node or a group of attack simulation nodes and is traffic sent towards the production target(s) / network(s) being validated.

[0060] “Expected Rate” is the expected rate an attack simulation should run at towards the production target(s) / network(s) and is typically defined in CPS, Kbps, PPS, or RPS. The expected rate may be per attack simulation node or cumulatively for a group of attack simulation nodes.

[0061] “Tolerance factor” is the amount of deviation above or below the expected rate, the system is willing to tolerate prior to initiating additional actions, e.g., terminating the attack simulation, stopping part of the simulations etc. Multiple actions may be taken post tolerance factor deviation, depending on specified duration settings or other settings.

[0062] “Specified Tolerance Duration” or “predetermined time period” is a time period for which the tolerance factor may be exceeded prior to taking some action with regards to a single attack simulation node or multiple (e.g., all) attack simulation nodes. This is typically defined in seconds, e.g., 30 seconds specified tolerance duration.

[0063] “Actual Rate” is the rate at which an attack simulation is running, based on Outgoing traffic or Incoming traffic or a combination thereof.

[0064] “Attack alter action” is an action to be taken when a decision is made to cut-off or alter the simulated attack.

[0065] “System stability (System health)” may be based on response time and deviation from regular baseline times of monitors and / or agents, as defined in US Patent 10,509,909 and PCT Publication WO 2023 / 057950.

[0066] “Non-Disruptive DDoS (ND-DDoS or NDDDoS) testing” may include testing of production systems for DDoS vulnerabilities or weaknesses that does not require a maintenance period, for example, as described in the production networks of US Patent 10,509,909 and PCT Publication WO 2023 / 057950 and / or US Patent Publication 2023 / 0156032 and PCT Publication W02023057950. Additionally, any other testing which identifies DDoS weaknesses in production environments without the requirement for a maintenance window or downtime of the production environment is also suitable for Non-Disruptive DDoS Testing. This method of DDoS testing may be performed on a production network without causing any disruption to the tested production network. One characteristic of Non- Disruptive DDoS testing is the ability to launch a large number of DDoS attacks over a given time period of lengths such as, days, weeks, months, or years without affecting production services. This allows for thousands of simulations to be performed, allowing big data to be gathered on the vulnerability level of the environment being evaluated. Prior to the advent of Non-Disruptive DDoS testing, as disclosed in the aforementioned patent documents, it was not possible to practically check the DDoS attack surface of an organization in production, or gather such large amounts of DDoS vulnerability data points, since traditional testing (sometimes referred to as DDoS testing or red team testing) methods cause downtime to production environments and a maintenance window is required by organizations, limiting the amount of such testing and very little coverage of the DDoS attack surface, meaning very few DDoS vulnerability data points. This made it impossible or impractical to confirm DDoS vulnerability through big data, Al, machine learning (ML), or other statistical models.

[0067] “Production Networks” may include real Information Technology (IT) Production environments, live environments serving commercial, governmental, or other organization needs, but typically not quality assurance (QA) labs or staging environments. The production environments may be, for example, hosted on the cloud, infrastructure, or other locations.

[0068] “Production Target” (also known as a target) may include a point that could be attacked on a production network, typically and FQDN (fully qualified domain name) or IP (Internet Protocol) address. Some examples of targets are 184.23.44.2 or 8.8.8.8 or www.mazebolt.com or mazebolt.com. A target may also be a combination of address, such as IP, or FQDN name, and a port. For example, some targets with an address and a port are: www. mazebolt. com:443, or 8.8.8.8:53, or 184.23.44.2:80. The port is specified after the “:”in the examples. “Production environment, environment, or IT environment or production IT environment” may include any aspect of an IT network, cloud, or other online services that relate to ensuring and serving business needs. For example, a bank’s production environment may be online banking services or mobile banking services that customers use and rely upon for services consumed. Another example may be a gaming company that has online games that users can play on their website. Another example may be an insurance company having online VPN services for remote insurance agents to access internal insurance quoting systems. Production environments are what organizations rely upon for their business continuity for online services. Production environments are not staging or testing environments, they are live environments typically used by customers. Typically, in the event a production environment is down or unavailable, this will cause severe interruptions to business continuity. For example, if a trading platform production environment is down or unavailable to customers, customers will not be able to place trades, and this may cause severe financial damage to customers relying on the platform and the business hosting the platform. The use of the word “environment” may also be used to describe a logical or physical, or conceptual construct to understand the realm in which security operations are taking place. This allows users of the system to have a contextual understanding of how to interpret vulnerability data gained during vulnerability assessments and attack simulations, or other operational aspects. Environments may include DDoS security components, and production services. For example, an environment may be a particular subnet of production services, a particular region in a cloud provider, various security settings taken into consideration, or a combination thereof. Environments typically contain DDoS security components. An example of the use of the term “environment” may be, “In the London environment using vendor_x DDoS protection, an overall vulnerability level of 38%” was identified. Another example is, “Go check the Chicago environment for all layer 4 DDoS attacks”. There are many uses for the term “environment”, and the meaning may depend on the context. ASPECTS OF THE DISCLOSURE

[0069] In some aspects of the present disclosure, downtime or disruption towards targets, services, or systems are prevented. Abnormal Rate Cut-off enables proactively safeguarding services against service or target disruption during testing, ensuring uninterrupted service availability for the users.

[0070] In some aspects of the present disclosure, setting the expected rate of attack and specified tolerance duration, allows non-disruptive testing to simulate more accurately the testing of the target system's stability and response to different attack intensities. In addition, setting the expected rate of attack and specified tolerance duration, ensures that the outcomes align with the expected attack rate as initially intended by the user and the system.

[0071] In some aspects of the present disclosure, the method allows users to modify the rate (e.g., CPS, PPS, Kbps, or RPS) and specified tolerance duration parameters to align with specific testing requirements and service capabilities, providing flexibility and adaptability. This can also be automatically accomplished by the disclosed system.

[0072] In some aspects of the present disclosure, the system continuously monitors the “incoming traffic” or “outgoing traffic” or a combination thereof and measures the “actual rate” of the attack against the defined “expected rate” parameter and the “tolerance factor”. Using this rate monitoring, the system may initiate an “attack alter action”.

[0073] In some aspects of the present disclosure, if the attack's actual rate surpasses the expected rate multiplied by the tolerance factor for the specified tolerance duration, the attack alter action is triggered. This either immediately stops the attack simulation or alters the attack in some way, preventing any potential downtime or service disruption.

[0074] In some aspects of the present disclosure, upon stopping or altering the attack, the system may generate event reports to inform the user about one or more of the following: the time that the system detected an abnormality; the attack alter action(s) taken; the actual detected rate; the specified tolerance duration; the simulation stop time; and / or other logging information that may be available. SYSTEM DESCRIPTION

[0075] Reference is now made to Fig. 1, which is a block diagram view of an attack simulation system 10 constructed and operative in accordance with an embodiment of the present disclosure. The attack simulation system 10 includes one or more attack simulation nodes 12, which may be devices configured to perform a simulated attack 14 towards a production target / network 16. The simulated attack 14 may be any suitable attack. In some embodiments, the simulated attack 14 may be (or include) a non-disruptive Distributed denial of service (DDoS) attack.

[0076] In some embodiments, the attack simulation system 10 may include one or monitor nodes 18 to monitor the effect of the simulated attack 14 on the production target / network 16, for example, by sending messages to production target / network 16 and observing the response times to the messages to determine if the production target / network 16 has been degraded too much by the simulated attack 14.

[0077] In some embodiments, the attack simulation system 10 may include a management node 20 or orchestration function. In some embodiments, the management node 20 is a separate device / node from the attack simulation nodes 12 or monitor nodes 18. In some embodiments, the functionality of the management node 20 may be included in one or more of the attack simulation nodes 12 and / or in one or more of the monitor nodes 18.

[0078] Each attack simulation node 12 may be monitored so as to control the simulated attack 14 generated by that attack simulation node 12 towards production target / network 16. In some embodiments, each attack simulation node 12 may monitor and control itself autonomously by monitoring the simulated attack 14 that it generates towards production target / network 16 and by controlling the simulated attack 14 that it generates. In other embodiments, any one of the attack simulation nodes 12 may be monitored and / or controlled by another device or devices such as the management node 20 or one of the monitor nodes 18 for example, or a cloudbased server or servers. For the sake of simplicity, the description below assumes that each attack simulation node 12 monitors and controls the simulated attack 14 itself. For the sake of simplicity, reference is made to a single attack simulation node 12.

[0079] The attack simulation node 12 includes processing circuitry 22, and a memory 24 configured to store data used by the processing circuitry 22. In practice, some or all of the functions of processing circuitry 22 may be combined in a single physical component or, alternatively, implemented using multiple physical components. These physical components may comprise hard-wired or programmable devices, or a combination of the two. In some embodiments, at least some of the functions of the processing circuitry 22 may be carried out by a programmable processor, (e.g., central processing unit (CPU)) under the control of suitable software. This software may be downloaded to a device in electronic form, over a network, for example. Alternatively, or additionally, the software may be stored in tangible, non-transitory computer-readable storage media, such as optical, magnetic, or electronic memory.

[0080] In some embodiments, the processing circuitry 22 may execute an operating system 26 and software 28, which may run on the operating system 26. The processing circuitry 22 may also include network interface controller hardware 30. The steps described with reference to Figs. 2-4 are described as being performed by processing circuitry 22. In some embodiments, the steps described with reference to Figs. 2-4 may be performed by the operating system 26, the software 28, the network interface controller hardware 30, or any suitable combination of the operating system 26, software 28, and network interface controller hardware 30. It should be noted that the attack simulation system 10 may include any suitable additional elements, for example, one or more of the elements described in US Patent 10,509,909 and / or PCT Publication WO 2023 / 057950.

[0081] Reference is now made to Fig. 2, which is a flowchart 200 including steps in a method of operation of attack simulation system 10 Fig. 1. In some embodiments, the processing circuitry 22 is configured to configure network interface controller hardware 30 to limit the rate of the simulated attack 14 in response to the rate of the simulated attack exceeding the predetermined threshold, as described in more detail with reference to the steps of blocks 204-208 (block 202). In some embodiments, the processing circuitry 22 is configured to execute operating system software 26 to limit the rate of the simulated attack 14 in response to the rate of the simulated attack exceeding the predetermined threshold, as described in more detail with reference to the steps of blocks 204-208.

[0082] The processing circuitry 22 is configured to monitor the simulated attack 14 being performed by the attack simulation node 12. In some embodiments, the processing circuitry 22 is configured to monitor a rate of the simulated attack being performed by the attack simulation node 12 (block 204). As mentioned previously, the rate of the simulated attack 14 may be defined by one or more of the following: connections per second (CPS); packets per second (PPS); kilobits per second (Kbps); or requests per second (RPS). The rate of simulated attack 14 may be monitored by operating system 26, software 28, and / or network interface controller hardware 30.

[0083] The processing circuitry 22 is configured to determine whether the simulated attack 14 exceeds a predetermined threshold (block 206). The predetermined threshold may be any one of the following: a fixed threshold; a dynamic threshold; or a threshold computed from environmental statistics, as previously discussed. In some embodiments, processing circuitry 22 is configured to determine whether the rate of the simulated attack 14 exceeds the predetermined threshold. In some embodiments, processing circuitry 22 is configured to determine whether the rate of the simulated attack 14 exceeds the predetermined threshold for a predetermined time period. For example, the processing circuitry 22 may sample CPU and / or memory statistics and / or the attack rate (e.g., based on CPS, PPS, Kbps, or RPS) over time and compute the upper threshold and / or the lower threshold based on applying any suitable statistical or computational method to the sampled values in a suitable time window. For example, the upper limit may be set based on a CPU running average of sampled CPU statistic values. Another example of a dynamic threshold could be RAM (memory) statistic X being monitored at frequent periods, where X is used to create an ongoing running average, and this running average is dynamically influencing the upper and lower thresholds to cut-off any running attack. The threshold could also be derived from direct environmental statistics like RAM, CPU, or network statistics output generated by default OS output. E.g. Generating statistics from a command similar to “netstat -tan | awk '{print $6}' | sort | uniq -c” on a Linux system. All the statistics may be used to refine the threshold in conjunction with or without the actual rate of the attack, i.e., the rate of the attack with a rate invariant being one of the tracked statistics.

[0084] The simulated attack 14 may be monitored to determine whether the simulated attack 14 exceeds (becomes lower than) a minimum threshold and / or exceeds (becomes higher than) a maximum threshold, as described in more detail with reference to Figs. 3 and 4, respectively.

[0085] The processing circuitry 22 is configured to perform an action associated with the simulated attack 14 in response to the simulated attack 14 exceeding the predetermined threshold (optionally for the predetermined time period) (block 208). The action performed may include terminating the simulated attack 14, or adjusting or limiting (a rate of) the simulated attack 14. In some embodiments, the action may include notifying at least one other attack simulation node and / or a management node 20 of node statistics.

[0086] The processing circuitry 22 is configured to adjust, or limit, or terminate the simulated attack 14 in response to the simulated attack 14 exceeding the predetermined threshold (optionally for the predetermined time period) (block 210). In some embodiments, the processing circuitry 22 is configured to terminate the simulated attack 14, or adjust or limit the rate of the simulated attack 14 in response to the rate of the simulated attack 14 exceeding the predetermined threshold (optionally for the predetermined time period). The rate of the simulated attack 14 may be limited using the operating system 26 and / or the network interface controller hardware 30 configured in the step of block 202, for example.

[0087] As previously mentioned, any (or all) of the steps of blocks 202-212 may be performed by the attack simulation node 12 performing the simulated attack 14 or by any other suitable node or nodes. When the processing circuitry 22 is not in the attack simulation node 12 being monitored, the processing circuitry 22 is configured to notify the attack simulation node 12 being monitored and / or management node 20 to adjust, limit or terminate the simulated attack 14.

[0088] Reference is now made to Fig. 3, which is a flowchart 300 including steps in a method to monitor for a minimum attack rate in attack simulation system 10 of Fig. 1. The processing circuitry 22 is configured to (continuously or intermittently) monitor the rate of simulated attack 14 (block 302) based on a minimum threshold rate or based on the actual rate and a tolerance factor (block 304) and optionally based on a threshold time period (block 306). At a decision block 308, the processing circuitry 22 is configured to determine whether the rate of the simulated attack 14 is lower than the predetermined minimum threshold (optionally for the predetermined time period). If the rate of the simulated attack 14 is not lower than the predetermined minimum threshold (optionally for the predetermined time period), the processing circuitry 22 allows the simulated attack 14 to continue (block 310) and repeats the monitoring of block 302. In response to the rate of the simulated attack 14 being lower than the predetermined minimum threshold (optionally for the predetermined time period), the processing circuitry 22 is configured to: terminate the simulated attack 14 (block 312); or increase the rate of the simulated attack 14 (block 314) and allow the simulated attack 14 to continue at the increased rate (block 310) and repeat the monitoring of block 302.

[0089] Reference is now made to Fig. 4, which is a flowchart 400 including steps in a method to monitor for a maximum attack rate in the attack simulation system 10 of Fig. 1. The processing circuitry 22 is configured to (continuously or intermittently) monitor the rate of simulated attack 14 (block 402) based on a maximum threshold rate or based on the actual rate and a tolerance factor (block 404) and optionally based on a threshold time period (block 406). At a decision block 408, the processing circuitry 22 is configured to determine whether the rate of the simulated attack 14 is higher than the predetermined maximum threshold (optionally for the predetermined time period). If the rate of the simulated attack 14 is not higher than the predetermined maximum threshold (optionally for the predetermined time period), the processing circuitry 22 allows the simulated attack 14 to continue (block 410) and repeats the monitoring of block 402. In response to the rate of the simulated attack 14 being higher than the predetermined maximum threshold (optionally for the predetermined time period), the processing circuitry 22 is configured to: terminate the simulated attack 14 (block 412); or decrease the rate of the simulated attack 14 or limit the rate of the simulated attack (block 414) and allow the simulated attack 14 to continue at the reduced rate (block 410) and repeat the monitoring of block 402. The rate of the simulated attack 14 may be limited using the operating system 26 and / or the network interface controller hardware 30 configured in the step of block 202 (Fig. 2), for example.

[0090] The implementation of the method and / or system of examples of the disclosure can involve performing or completing selected tasks manually, automatically, or a combination thereof. Moreover, according to actual instrumentation and equipment of examples of the method and / or system of the disclosure, several selected tasks could be implemented by hardware, by software or by firmware or by a combination thereof using an operating system or a cloudbased platform.

[0091] The following is a summary of examples of the present disclosure.

[0092] Example 1: A method for controlling a simulated attack performed by an attack simulation node towards a production target and / or production network, the method comprising: monitoring the simulated attack being performed by the attack simulation node; determining whether the simulated attack exceeds a predetermined threshold; and performing an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

[0093] Example 2: The method according to example 1, wherein the threshold is any one of the following: a fixed threshold; a dynamic threshold; or a threshold computed from environmental statistics.

[0094] Example 3: The method according to example 1 or example 2, wherein the performing the action includes adjusting, or limiting, or terminating the simulated attack in response to the simulated attack exceeding the predetermined threshold.

[0095] Example 4: The method according to any of examples 1-3, wherein the simulated attack is a non-disruptive Distributed denial of service (DDoS) attack. Example 5: The method according to any of examples 1-4, wherein the monitoring, the determining, and the performing an action is performed by the attack simulation node.

[0096] Example 6: The method according to any of examples 1-5, wherein: the monitoring includes monitoring a rate of the simulated attack being performed by the attack simulation node; the determining includes determining whether the rate of the simulated attack exceeds the predetermined threshold; and the method further comprises terminating the simulated attack, or adjusting or limiting the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0097] Example 7: The method according to example 6, further comprising configuring network interface controller hardware to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0098] Example 8: The method according to example 6 or example 7, further comprising executing operating system software to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0099] Example 9: The method according to any of examples 6-8, wherein: the determining includes determining whether the rate of the simulated attack is lower than the predetermined threshold; and the terminating includes terminating the simulated attack, or increasing the rate of the simulated attack in response to the rate of the simulated attack being lower than the predetermined threshold.

[0100] Example 10: The method according to any of examples 6-9, wherein: the determining includes determining whether the rate of the simulated attack is higher than the predetermined threshold; and the terminating includes terminating the simulated attack, or limiting or decreasing the rate of the simulated attack in response to the rate of the simulated attack being higher than the predetermined threshold.

[0101] Example 11: The method according to any of examples 6-10, wherein the rate of the simulated attack is defined by one or more of the following: connections per second (CPS); packets per second (PPS); kilobits per second (Kbps); or requests per second (RPS).

[0102] Example 12: The method according to any of examples 6-11, wherein: the determining includes determining whether the rate of the simulated attack exceeds the predetermined threshold for a predetermined time period; and the method further comprising terminating the simulated attack, or adjusting or limiting the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold for the predetermined time period.

[0103] Example 13: The method according to any of examples 1-12, further comprising notifying at least one other attack simulation node and / or a management node to adjust, limit or terminate the simulated attack.

[0104] Example 14: The method according to any of examples 1-12, further comprising notifying at least one other attack simulation node and / or a management node of node statistics.

[0105] Example 15: A device for controlling a simulated attack performed by an attack simulation node towards a production target and / or production network, the device comprising: processing circuitry configured to: monitor the simulated attack being performed by the attack simulation node; determine whether the simulated attack exceeds a predetermined threshold; and perform an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold; and a memory configured to store data used by the processing circuitry.

[0106] Example 16: The device according to example 15, wherein the threshold is any one of the following: a fixed threshold; a dynamic threshold; or a threshold computed from environmental statistics.

[0107] Example 17: The device according to example 15 or example 16, wherein the processing circuitry is configured to adjust, or limit, or terminate the simulated attack in response to the simulated attack exceeding the predetermined threshold. Example 18: The device according to any of examples 15-17, wherein the simulated attack is a non-disruptive Distributed denial of service (DDoS) attack.

[0108] Example 19: The device according to any of examples 15-18, wherein the device includes the attack simulation node, which includes the processing circuitry configured to: simulate the attack towards the production target and / or the production network; monitor the simulated attack; determine whether the simulated attack exceeds the predetermined threshold; and perform the action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

[0109] Example 20: The device according to any of examples 15-19, wherein the processing circuitry is configured to: monitor a rate of the simulated attack being performed by the attack simulation node; determine whether the rate of the simulated attack exceeds the predetermined threshold; and terminate the simulated attack, or adjust or limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0110] Example 21: The device according to example 20, wherein the processing circuitry is configured to configure network interface controller hardware to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0111] Example 22: The device according to example 20 or example 21, wherein the processing circuitry is configured to execute operating system software to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

[0112] Example 23: The device according to any of examples 20-22, wherein the processing circuitry is configured to: determine whether the rate of the simulated attack is lower than the predetermined threshold; and terminate the simulated attack, or increase the rate of the simulated attack in response to the rate of the simulated attack being lower than the predetermined threshold.

[0113] Example 24: The device according to any of examples 20-23, wherein the processing circuitry is configured to: determine whether the rate of the simulated attack is higher than the predetermined threshold; and terminate the simulated attack, or limit or decrease the rate of the simulated attack in response to the rate of the simulated attack being higher than the predetermined threshold.

[0114] Example 25: The device according to any of examples 20-24, wherein the rate of the simulated attack is defined by one or more of the following: connections per second (CPS); packets per second (PPS); kilobits per second (Kbps); or requests per second (RPS).

[0115] Example 26: The device according to any of examples 20-25, wherein the processing circuitry is configured to: determine whether the rate of the simulated attack exceeds the predetermined threshold for a predetermined time period; and terminate the simulated attack, or adjust or limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold for the predetermined time period.

[0116] Example 27: The device according to any of examples 15-26, wherein the processing circuitry is configured to notify at least one other attack simulation node and / or a management node to adjust, limit, inform of node statistics or terminate the simulated attack.

[0117] Example 28: The device according to any of examples 15-26, wherein the processing circuitry is configured to notify at least one other attack simulation node and / or a management node of node statistics.

[0118] Example 29: A software product, comprising a non-transient computer-readable medium in which program instructions are stored, which instructions, when read by a central processing unit (CPU), cause the CPU to: monitor a simulated attack performed by an attack simulation node towards a production target and / or production network; determine whether the simulated attack exceeds a predetermined threshold; and perform an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

[0119] For example, hardware for performing selected tasks according to examples of the disclosure could be implemented as a chip or a circuit. As software, selected tasks according to examples of the disclosure could be implemented as a plurality of software instructions being executed by a computer using any suitable operating system. In an exemplary example of the disclosure, one or more tasks according to exemplary examples of method and / or system as described herein are performed by a data processor, such as a computing platform for executing a plurality of instructions. Optionally, the data processor includes a volatile memory for storing instructions and / or data and / or a non-volatile storage, for example, non- transitory storage media such as a magnetic hard-disk and / or removable media, for storing instructions and / or data. Optionally, a network connection is provided as well. A display and / or a user input device such as a keyboard or mouse are optionally provided as well.

[0120] For example, any combination of one or more non-transitory computer readable (storage) medium(s) may be utilized in accordance with the above-listed examples of the present disclosure. The non-transitory computer readable (storage) medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc readonly memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store, a program for use by or in connection with an instruction execution system, apparatus, or device.

[0121] A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0122] As will be understood with reference to the paragraphs and the referenced drawings, provided above, various examples of computer-implemented methods are provided herein, some of which can be performed by various examples of apparatuses and systems described herein and some of which can be performed according to instructions stored in non-transitory computer-readable storage media described herein. Still, some examples of computer-implemented methods provided herein can be performed by other apparatuses or systems and can be performed according to instructions stored in computer-readable storage media other than that described herein, as will become apparent to those having skill in the art with reference to the examples described herein. Any reference to systems and computer- readable storage media with respect to the following computer-implemented methods is provided for explanatory purposes, and is not intended to limit any of such systems and any of such non-transitory computer-readable storage media with regard to examples of computer-implemented methods described above. Likewise, any reference to the following computer-implemented methods with respect to systems and computer-readable storage media is provided for explanatory purposes, and is not intended to limit any of such computer-implemented methods disclosed herein.

[0123] The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various examples of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, block diagrams and / or flowchart illustration, and combinations of blocks in the block diagrams and / or flowchart illustration, can be implemented by special purpose hardware -based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions. The descriptions of the various examples of the present disclosure have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the examples disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described examples.

[0124] As used herein, the singular form "a", "an" and "the" include plural references unless the context clearly dictates otherwise.

[0125] It is appreciated that certain features of the disclosure, which are, for clarity, described in the context of separate examples, may also be provided in combination in a single example. Conversely, various features of the disclosure, which are, for brevity, described in the context of a single example, may also be provided separately or in any suitable sub-combination or as suitable in any other described example of the disclosure. Certain features described in the context of various examples are not to be considered essential features of those examples, unless the example is inoperative without those elements.

[0126] The above-described processes including portions thereof can be performed by software, hardware and combinations thereof. These processes and portions thereof can be performed by computers, computer-type devices, workstations, cloud-based platforms, processors, micro-processors, other electronic searching tools and memory and other non-transitory storage-type devices associated therewith. The processes and portions thereof can also be embodied in programmable non-transitory storage media, for example, compact discs (CDs) or other discs including magnetic, optical, etc., readable by a machine or the like, or other computer usable storage media, including magnetic, optical, or semiconductor storage, or other source of electronic signals.

[0127] The processes (methods) and systems, including components thereof, herein have been described with exemplary reference to specific hardware and software. The processes (methods) have been described as exemplary, whereby specific steps and their order can be omitted and / or changed by persons of ordinary skill in the art to reduce these examples to practice without undue experimentation. The processes (methods) and systems have been described in a manner sufficient to enable persons of ordinary skill in the art to readily adapt other hardware and software as may be needed to reduce any of the examples to practice without undue experimentation and using conventional techniques. Various features of the disclosure which are, for clarity, described in the contexts of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features of the disclosure which are, for brevity, described in the context of a single embodiment may also be provided separately or in any suitable sub-combination. The embodiments described above are cited by way of example, and the present disclosure is not limited by what has been particularly shown and described hereinabove. Rather the scope of the disclosure includes both combinations and sub-combinations of the various features described hereinabove, as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not disclosed in the prior art.

Claims

CLAIMSWhat is claimed is:

1. A method for controlling a simulated attack performed by an attack simulation node towards a production target and / or production network, the method comprising: monitoring the simulated attack being performed by the attack simulation node; determining whether the simulated attack exceeds a predetermined threshold; and performing an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

2. The method according to claim 1, wherein the threshold is any one of the following: a fixed threshold; a dynamic threshold; or a threshold computed from environmental statistics.

3. The method according to claim 1 or claim 2, wherein the performing the action includes adjusting, or limiting, or terminating the simulated attack in response to the simulated attack exceeding the predetermined threshold.

4. The method according to any of claims 1-3, wherein the simulated attack is a non-disruptive Distributed denial of service (DDoS) attack.

5. The method according to any of claims 1-4, wherein the monitoring, the determining, and the performing an action is performed by the attack simulation node.

6. The method according to any of claims 1-5, wherein: the monitoring includes monitoring a rate of the simulated attack being performed by the attack simulation node;the determining includes determining whether the rate of the simulated attack exceeds the predetermined threshold; and the method further comprises terminating the simulated attack, or adjusting or limiting the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

7. The method according to claim 6, further comprising configuring network interface controller hardware to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

8. The method according to claim 6 or claim 7, further comprising executing operating system software to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

9. The method according to any of claims 6-8, wherein: the determining includes determining whether the rate of the simulated attack is lower than the predetermined threshold; and the terminating includes terminating the simulated attack, or increasing the rate of the simulated attack in response to the rate of the simulated attack being lower than the predetermined threshold.

10. The method according to any of claims 6-9, wherein: the determining includes determining whether the rate of the simulated attack is higher than the predetermined threshold; and the terminating includes terminating the simulated attack, or limiting or decreasing the rate of the simulated attack in response to the rate of the simulated attack being higher than the predetermined threshold.

11. The method according to any of claims 6-10, wherein the rate of the simulated attack is defined by one or more of the following: connections per second (CPS); packets per second (PPS); kilobits per second (Kbps); or requests per second (RPS).

12. The method according to any of claims 6-11, wherein: the determining includes determining whether the rate of the simulated attack exceeds the predetermined threshold for a predetermined time period; and the method further comprising terminating the simulated attack, or adjusting or limiting the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold for the predetermined time period.

13. The method according to any of claims 1-12, further comprising notifying at least one other attack simulation node and / or a management node to adjust, limit or terminate the simulated attack.

14. The method according to any of claims 1-12, further comprising notifying at least one other attack simulation node and / or a management node of node statistics.

15. A device for controlling a simulated attack performed by an attack simulation node towards a production target and / or production network, the device comprising: processing circuitry configured to: monitor the simulated attack being performed by the attack simulation node; determine whether the simulated attack exceeds a predetermined threshold; and perform an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold; and a memory configured to store data used by the processing circuitry.

16. The device according to claim 15, wherein the threshold is any one of the following: a fixed threshold; a dynamic threshold; or a threshold computed from environmental statistics.

17. The device according to claim 15 or claim 16, wherein the processing circuitry is configured to adjust, or limit, or terminate the simulated attack in response to the simulated attack exceeding the predetermined threshold.

18. The device according to any of claims 15-17, wherein the simulated attack is a non-disruptive Distributed denial of service (DDoS) attack.

19. The device according to any of claims 15-18, wherein the device includes the attack simulation node, which includes the processing circuitry configured to: simulate the attack towards the production target and / or the production network; monitor the simulated attack; determine whether the simulated attack exceeds the predetermined threshold; and perform the action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

20. The device according to any of claims 15-19, wherein the processing circuitry is configured to: monitor a rate of the simulated attack being performed by the attack simulation node; determine whether the rate of the simulated attack exceeds the predetermined threshold; and terminate the simulated attack, or adjust or limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

21. The device according to claim 20, wherein the processing circuitry is configured to configure network interface controller hardware to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

22. The device according to claim 20 or claim 21, wherein the processing circuitry is configured to execute operating system software to limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold.

23. The device according to any of claims 20-22, wherein the processing circuitry is configured to: determine whether the rate of the simulated attack is lower than the predetermined threshold; and terminate the simulated attack, or increase the rate of the simulated attack in response to the rate of the simulated attack being lower than the predetermined threshold.

24. The device according to any of claims 20-23, wherein the processing circuitry is configured to: determine whether the rate of the simulated attack is higher than the predetermined threshold; and terminate the simulated attack, or limit or decrease the rate of the simulated attack in response to the rate of the simulated attack being higher than the predetermined threshold.

25. The device according to any of claims 20-24, wherein the rate of the simulated attack is defined by one or more of the following: connections per second (CPS); packets per second (PPS); kilobits per second (Kbps); or requests per second (RPS).

26. The device according to any of claims 20-25, wherein the processing circuitry is configured to: determine whether the rate of the simulated attack exceeds the predetermined threshold for a predetermined time period; andterminate the simulated attack, or adjust or limit the rate of the simulated attack in response to the rate of the simulated attack exceeding the predetermined threshold for the predetermined time period.

27. The device according to any of claims 15-26, wherein the processing circuitry is configured to notify at least one other attack simulation node and / or a management node to adjust, limit, inform of node statistics or terminate the simulated attack.

28. The device according to any of claims 15-26, wherein the processing circuitry is configured to notify at least one other attack simulation node and / or a management node of node statistics.

29. A software product, comprising a non-transient computer-readable medium in which program instructions are stored, which instructions, when read by a central processing unit (CPU), cause the CPU to: monitor a simulated attack performed by an attack simulation node towards a production target and / or production network; determine whether the simulated attack exceeds a predetermined threshold; and perform an action associated with the simulated attack in response to the simulated attack exceeding the predetermined threshold.

Images