Patent ID: 11895145
Assignee: AKAMAL TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method of automatically selecting rules to install in a network protection device to mitigate an attack in real-time or near real-time, the method operable in at least one computer comprising at least one hardware processor and memory storing computer instructions for execution on the at least one hardware processor, the method comprising:
receiving an attack profile with a plurality of traffic attributes, other than source IP address, that describe observed network traffic in a network attack;
receiving a plurality of descriptions of rules for filtering network traffic, said rules having been previously created for addressing other network attacks that occurred prior to observation of the network attack;
where each of the plurality of descriptions of rules comprises: a list of one or more traffic attributes other than source IP address that appear in a corresponding rule, such that each of the plurality of descriptions of rules is associated with the corresponding rule but is distinct therefrom;
scoring each of the plurality of descriptions of rules based at least in part on common traffic attributes with the attack profile; and,
by comparing scores for the plurality of descriptions of rules, selecting one or more of the rules for installation in a network protection device to filter against the network attack in real-time or near real-time.