EXHIBIT 2

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 1 of 23 PageID #: 49
1

Claim Chart

U.S. Patent No. 

8,265,089

CDNetworks Application Shield/Flood Shield

7. A gateway 

computer for use in 

a computer 

communication 

network system, the 

gateway computer 

comprising a nontransient software 

storage device with 

the following 

software encoded 

therein: a gateway 

module and an 

enhanced requesting 

module; wherein:

CDNetworks’ network receives data packets from users on the internet. 

Data packets from a user enter the network through an edge router (a 

gateway computer) at a CDNetwork Point-of-Presence.

CDNetworks has a network of over 200,000 servers and over 2,800 global 

Points of Presence (PoPs).

See https://www.cdnetworks.com/

See https://www.cdnetworks.com/cloud-security/flood-shield/

“Flood Shield DDoS deflection technology is deployed on CDNetworks’ 

distributed Points-of-Presence (PoPs). It is a cloud-based ‘always-on’

mitigation service with virtually unlimited capacity.”

https://www.cdnetworks.com/cloud-security/flood-shield/

“Flood Shield is deployed on CDNetworks’ huge global infrastructure 

with data centers in the USA, Europe, Asia, and mainland China. With 

over 12 global DDoS scrubbing centers and 15Tbps of total capacity, it is 

designed to protect websites and network infrastructures against even the 

most sophisticated and large-scale volumetric attacks.”

https://www.cdnetworks.com/cloud-security/flood-shield/

“Flood Shield is deployed on CDNetworks’ distributed Points-of-Presence 

(PoPs). It is a cloud-based ‘always on’ solution with virtually unlimited 

capacity. It does not require sophisticated deployments and changes to 

customers’ network and provides automated transparent scaling.

Flood Shield is provided either via a simple DNS change, typically to 

protect web sites and HTTP/S traffic, or through an anycast IP in order to 

protect entire network infrastructures, including multiple domains, servers 

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 2 of 23 PageID #: 50
2

and protocols. With the customers’ traffic routed through CDNetworks’ 

PoPs, DDoS attacks hit the CDNetwork infrastructure rather than our 

customers’ servers and networks. CDNetworks’ PoPs detect and deflect 

both application-layer attacks (L7) and all known types of network-layer 

attacks (L3/L4), including Ack and Syn floods, UDP floods, ICMP floods, 

CC attacks and more.”

https://documents.cdnetworks.com/document/15920/floodshield-how-itwork

“Application Shield is a cloud-based WAF and DDoS protection solution, 

deployed on CDNetworks global Points-of presence (PoPs) to detect and 

defend against web attacks in real-time. This happens at the edge of the 

network, far before the attack can hit, manipulate, or overwhelm the 

customers’ data centers and origin servers.”

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

CDNetworks has PoPs located in Ashburn, VA; Boston, MA; Chicago, 

IL; Dallas, TX; Denver, CO; Los Angeles, CA; Miami, FL; New York, 

NY; San Jose, CA; and Seattle, WA

See https://www.cdnetworks.com/cdnpro-pricing/

the gateway module 

is structured, 

programmed and/or 

datacommunicationconnected to receive 

a first MPDU from 

a connection-based 

network of the 

computer 

communication 

network system, to 

disaggregate the 

first MPDU into a 

plurality of smaller 

data units (DUs), 

and selectively 

communicate the 

first DU to a 

receiver-side 

connectionless 

network of the 

computer 

communication 

CDNetworks’ edge routers receive packets (MPDUs) from the internet (a 

connection-based network), disaggregate/demux those packets into 

smaller packets (smaller DUs), and communicate the smaller packets to a 

target network (a receiver-side connectionless network).

“CDN Pro is a serverless Nginx Platform with control at the Edge, built-in 

security, and real-time acceleration for optimizing websites, APIs, and 

cloud applications.”

https://www.cdnetworks.com/cdnpro/

https://www.nginx.com/blog/load-balancing-with-nginx-plus-part-2/

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 3 of 23 PageID #: 51
3

network system; 

and

“The next key point of HTTP/2 is multiplexing. Instead of sending and 

receiving responses and requests as separate streams of data over multiple 

connections, HTTP/2 multiplexes them over one stream of bytes or one 

stream of data.”

https://www.nginx.com/blog/http2-module-nginx/

the enhanced 

requesting module 

is structured, 

programmed and/or 

datacommunicationconnected to collect 

selected network 

protocol data from 

the first MPDU, 

with the selected 

network protocol 

data including at 

least some network 

protocol data 

included in the first 

MPDU and not 

included in any of 

the plurality of 

DUs, and with the 

selected network 

protocol data 

relating exclusively 

to network 

protocols and 

including no data 

from any data 

payload(s) which 

may be present in 

CDNetworks collects network protocol data, such as IP addresses, from 

incoming data packets received from the internet. None of this network 

protocol data includes data from the packet payload.

“CDNetworks content delivery networks (CDN) serves thousands of large 

global enterprises, process TB-scale log data daily, including a massive 

access data and attack/defense samples. The platform’s big data and 

machine learning capabilities help detect network attack trends in realtime and automatically activates defense in advance. It also intelligently 

analyzes and identifies attacks, to model the normal behaviors of 

legitimate traffic including IP addresses, HTTP headers, cookies, and 

JavaScript snippets, etc.”

https://www.cdnetworks.com/cloud-security/flood-shield/

“Layer 4 DDoS Mitigation

CDN Pro is built upon our Edge Computing Platform. At the entry point 

of every edge Point of Presence (PoP) is a high-performance Layer 4 

distributed denial-of-service (DDoS) firewall. The firewall consists of a 

group of machines that analyze incoming traffic at line speed. Based on 

regularly updated rules, the firewall rejects suspicious packets that may 

endanger services and forwards only the ‘safe’ packets to the servers 

located behind the firewall. This feature is enabled by default for all edge 

services and is transparent to all the users.

Layer 7 DDoS Mitigation

The CDN Pro platform monitors the traffic in real-time to detect unusual 

behaviors at layer 7. Once an attack is identified, defense strategies will 

be deployed in both layer 4 and layer 7 to most effectively mitigate the 

impact to normal traffic. Since its inception, CDN Pro has successfully 

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 4 of 23 PageID #: 52
4

the MPDU; handled some of the world's largest DDoS attacks with bandwidth 

reaching 1.2Tbps and request rate as high as 35Mrps.”

https://docs.cdnetworks.com/en/cdn/docs/recipes/secure-delivery

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

“CDN Pro Global Service Load Balancer (GSLB) inspects the request 

traffic based on the pre-defined layer 4 and layer 7 policies for any 

security risks. If the request does not pose a threat, GSLB routes the 

request to the edge location that best serves the request.”

See https://www.cdnetworks.com/web-performance-blog/cdn-pro-withwaf-for-web-application-protection/

End Users

Customer Rules

OWASP Policies

CDN Pro WAF Origin of Web

Applications

2. CDN Pro L4, L7 Policies

6. WAF Policies

3. Responds Cached Copy

1. Request 5. Request to WAF 7. Fetch Content

4. CDN Pro Edge Logic Control Rules

Global Edge

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 5 of 23 PageID #: 53
5

1. Detect abnormal traffic by Customer Monitoring System

2. Determine the content of the attack and whether or not to bypass it, and 

implement detour using BGP

3. Divert traffic to CDNetworks 

4. Traffic cleaned at Scrubbing Center 

5. Deliver normal traffic to Customer Network

https://pr.cdnetworks.co.jp/blog-ddos-attack-countermeasures-using-gre/

the enhanced 

requesting module 

is further structured, 

programmed and/or 

datacommunicationconnected to apply 

a first rule to the 

selected network 

protocol data 

collected by the 

enhanced requesting 

module; and

CDNetworks analyzes the collected network protocol data to determine 

whether a DoS attack is occurring. 

“Layer 4 DDoS Mitigation

CDN Pro is built upon our Edge Computing Platform. At the entry point 

of every edge Point of Presence (PoP) is a high-performance Layer 4 

distributed denial-of-service (DDoS) firewall. The firewall consists of a 

group of machines that analyze incoming traffic at line speed. Based on 

regularly updated rules, the firewall rejects suspicious packets that may 

endanger services and forwards only the ‘safe’ packets to the servers 

located behind the firewall. This feature is enabled by default for all edge 

services and is transparent to all the users.

Layer 7 DDoS Mitigation

The CDN Pro platform monitors the traffic in real-time to detect unusual 

behaviors at layer 7. Once an attack is identified, defense strategies will 

be deployed in both layer 4 and layer 7 to most effectively mitigate the 

impact to normal traffic. Since its inception, CDN Pro has successfully 

handled some of the world's largest DDoS attacks with bandwidth 

reaching 1.2Tbps and request rate as high as 35Mrps.”

https://docs.cdnetworks.com/en/cdn/docs/recipes/secure-delivery

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 6 of 23 PageID #: 54
6

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

1. Detect abnormal traffic by Customer Monitoring System

2. Determine the content of the attack and whether or not to bypass it, and 

implement detour using BGP

3. Divert traffic to CDNetworks 

4. Traffic cleaned at Scrubbing Center 

5. Deliver normal traffic to Customer Network

https://pr.cdnetworks.co.jp/blog-ddos-attack-countermeasures-using-gre/

“CDN Pro Global Service Load Balancer (GSLB) inspects the request 

traffic based on the pre-defined layer 4 and layer 7 policies for any 

security risks. If the request does not pose a threat, GSLB routes the 

request to the edge location that best serves the request.”

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 7 of 23 PageID #: 55
7

See https://www.cdnetworks.com/web-performance-blog/cdn-pro-withwaf-for-web-application-protection/

“Policies include IP/URL blacklist and whitelist, access control by IP 

address, URL, domain name.”

CDNetworks-DDoS-Product-Overview.pdf

the enhanced 

requesting module 

is further structured, 

programmed and/or 

datacommunicationconnected to 

selectively make a 

responsive reaction 

based, at least in 

part, upon the 

application of the 

first rule by the 

enhanced requesting 

module to the 

selected network 

protocol data.

If a DoS attack is detected based on the analysis of the collected network 

protocol data, CDNetworks does not deliver potentially data packets 

directly to the customer network but, instead, re-routes suspect packets to 

a Scrubbing Center or blocks them altogether.

“Layer 4 DDoS Mitigation

CDN Pro is built upon our Edge Computing Platform. At the entry point 

of every edge Point of Presence (PoP) is a high-performance Layer 4 

distributed denial-of-service (DDoS) firewall. The firewall consists of a 

group of machines that analyze incoming traffic at line speed. Based on 

regularly updated rules, the firewall rejects suspicious packets that may 

endanger services and forwards only the ‘safe’ packets to the servers 

located behind the firewall. This feature is enabled by default for all edge 

services and is transparent to all the users.

Layer 7 DDoS Mitigation

The CDN Pro platform monitors the traffic in real-time to detect unusual 

behaviors at layer 7. Once an attack is identified, defense strategies will 

be deployed in both layer 4 and layer 7 to most effectively mitigate the 

impact to normal traffic. Since its inception, CDN Pro has successfully 

handled some of the world's largest DDoS attacks with bandwidth 

reaching 1.2Tbps and request rate as high as 35Mrps.”

https://docs.cdnetworks.com/en/cdn/docs/recipes/secure-delivery

End Users

Customer Rules

OWASP Policies

CDN Pro WAF Origin of Web

Applications

2. CDN Pro L4, L7 Policies

6. WAF Policies

3. Responds Cached Copy

1. Request 5. Request to WAF 7. Fetch Content

4. CDN Pro Edge Logic Control Rules

Global Edge

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 8 of 23 PageID #: 56
8

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

1. Detect abnormal traffic by Customer Monitoring System

2. Determine the content of the attack and whether or not to bypass it, and 

implement detour using BGP

3. Divert traffic to CDNetworks 

4. Traffic cleaned at Scrubbing Center 

5. Deliver normal traffic to Customer Network

https://pr.cdnetworks.co.jp/blog-ddos-attack-countermeasures-using-gre/

“CDN Pro Global Service Load Balancer (GSLB) inspects the request 

traffic based on the pre-defined layer 4 and layer 7 policies for any 

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 9 of 23 PageID #: 57
9

security risks. If the request does not pose a threat, GSLB routes the 

request to the edge location that best serves the request.”

See https://www.cdnetworks.com/web-performance-blog/cdn-pro-withwaf-for-web-application-protection/

“Policies include IP/URL blacklist and whitelist, access control by IP 

address, URL, domain name.”

CDNetworks-DDoS-Product-Overview.pdf

10. The gateway 

of claim 7, wherein 

the responsive 

reaction made by 

the gateway 

includes one or 

more of the 

following types of 

responsive 

reactions: (i) 

filtering the first 

DU so that it is 

selectively not 

communicated to 

the connectionless 

network, (ii) 

regulating 

communication of 

the first DU to the 

connectionless 

network, (iii) 

reallocating 

network resources 

of the system, 

and/or (iv) sending 

out an alert.

If a DoS attack is detected based on the analysis of the collected network 

protocol data, CDNetworks does not deliver potentially data packets 

directly to the customer network but, instead, re-routes suspect packets to 

a Scrubbing Center or blocks them altogether. CDNetworks also notifies 

the customer of the suspected attack.

“Layer 4 DDoS Mitigation

CDN Pro is built upon our Edge Computing Platform. At the entry point 

of every edge Point of Presence (PoP) is a high-performance Layer 4 

distributed denial-of-service (DDoS) firewall. The firewall consists of a 

group of machines that analyze incoming traffic at line speed. Based on 

regularly updated rules, the firewall rejects suspicious packets that may 

endanger services and forwards only the ‘safe’ packets to the servers 

located behind the firewall. This feature is enabled by default for all edge 

services and is transparent to all the users.

Layer 7 DDoS Mitigation

The CDN Pro platform monitors the traffic in real-time to detect unusual 

behaviors at layer 7. Once an attack is identified, defense strategies will 

be deployed in both layer 4 and layer 7 to most effectively mitigate the 

impact to normal traffic. Since its inception, CDN Pro has successfully 

handled some of the world's largest DDoS attacks with bandwidth 

reaching 1.2Tbps and request rate as high as 35Mrps.”

https://docs.cdnetworks.com/en/cdn/docs/recipes/secure-delivery

End Users

Customer Rules

OWASP Policies

CDN Pro WAF Origin of Web

Applications

2. CDN Pro L4, L7 Policies

6. WAF Policies

3. Responds Cached Copy

1. Request 5. Request to WAF 7. Fetch Content

4. CDN Pro Edge Logic Control Rules

Global Edge

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 10 of 23 PageID #: 58
10

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

1. Detect abnormal traffic by Customer Monitoring System

2. Determine the content of the attack and whether or not to bypass it, and 

implement detour using BGP

3. Divert traffic to CDNetworks 

4. Traffic cleaned at Scrubbing Center 

5. Deliver normal traffic to Customer Network

https://pr.cdnetworks.co.jp/blog-ddos-attack-countermeasures-using-gre/

“CDN Pro Global Service Load Balancer (GSLB) inspects the request 

traffic based on the pre-defined layer 4 and layer 7 policies for any 

security risks. If the request does not pose a threat, GSLB routes the 

request to the edge location that best serves the request.”

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 11 of 23 PageID #: 59
11

See https://www.cdnetworks.com/web-performance-blog/cdn-pro-withwaf-for-web-application-protection/

20. A method of 

communicating a 

data unit through a 

computer 

communication 

network system, the 

method comprising 

the following steps:

CDNetworks delivers websites and web applications to over 99% of the 

world within milliseconds with its global content delivery network of over 

200,000 servers and over 2,800 global Points of Presence (PoPs).

https://www.cdnetworks.com/

receiving, by a 

gateway, a first 

MPDU from a 

connection-based 

network of the 

computer 

communication 

network system;

CDNetworks connects customer end-users to the internet (a connectionbased network). Data packets (MPDUs) being sent to a customer end-user 

enter the network through an edge router (a gateway) at a CDNetwork 

Point-of-Presence.

See https://www.cdnetworks.com/cloud-security/flood-shield/

“Flood Shield DDoS deflection technology is deployed on CDNetworks’ 

distributed Points-of-Presence (PoPs). It is a cloud-based ‘always-on’

mitigation service with virtually unlimited capacity.”

https://www.cdnetworks.com/cloud-security/flood-shield/

End Users

Customer Rules

OWASP Policies

CDN Pro WAF Origin of Web

Applications

2. CDN Pro L4, L7 Policies

6. WAF Policies

3. Responds Cached Copy

1. Request 5. Request to WAF 7. Fetch Content

4. CDN Pro Edge Logic Control Rules

Global Edge

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 12 of 23 PageID #: 60
12

“Flood Shield is deployed on CDNetworks’ huge global infrastructure 

with data centers in the USA, Europe, Asia, and mainland China. With 

over 12 global DDoS scrubbing centers and 15Tbps of total capacity, it is 

designed to protect websites and network infrastructures against even the 

most sophisticated and large-scale volumetric attacks.”

https://www.cdnetworks.com/cloud-security/flood-shield/

“Flood Shield is deployed on CDNetworks’ distributed Points-of-Presence 

(PoPs). It is a cloud-based ‘always on’ solution with virtually unlimited 

capacity. It does not require sophisticated deployments and changes to 

customers’ network and provides automated transparent scaling.

Flood Shield is provided either via a simple DNS change, typically to 

protect web sites and HTTP/S traffic, or through an anycast IP in order to 

protect entire network infrastructures, including multiple domains, servers 

and protocols. With the customers’ traffic routed through CDNetworks’ 

PoPs, DDoS attacks hit the CDNetwork infrastructure rather than our 

customers’ servers and networks. CDNetworks’ PoPs detect and deflect 

both application-layer attacks (L7) and all known types of network-layer 

attacks (L3/L4), including Ack and Syn floods, UDP floods, ICMP floods, 

CC attacks and more.”

https://documents.cdnetworks.com/document/15920/floodshield-how-itwork

https://pr.cdnetworks.co.jp/blog-ddos-attack-countermeasures-using-gre/

BGP = Border Gateway Protocol

EBGP = External BGP; for communication between two Autonomous

Systems (e.g., CDNetworks’ network and customer’s network) 

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 13 of 23 PageID #: 61
13

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

CDNetworks has PoPs located in Ashburn, VA; Boston, MA; Chicago, 

IL; Dallas, TX; Denver, CO; Los Angeles, CA; Miami, FL; New York, 

NY; San Jose, CA; and Seattle, WA

See https://www.cdnetworks.com/cdnpro-pricing/

CDNetworks has scrubbing centers located in New York, NY and Los 

Angeles, CA. See https://www.cdnetworks.com/about/global-networkmap/

CDNetworks has points-of-presence and/or edge computing sites in Texas 

are located at 6653 Pinecrest Drive, Plano, Texas 75024 and 1950 N 

Stemmons Freeway, Dallas, Texas 75207.

disaggregating, by 

the gateway, the 

first MPDU into a 

plurality of smaller 

data units (DUs);

CDNetworks’ edge routers receive packets (MPDUs) from the internet (a 

connection-based network), disaggregate/demux those packets into 

smaller packets (smaller DUs), and communicate the smaller packets to a 

target network (a receiver-side connectionless network).

“CDN Pro is a serverless Nginx Platform with control at the Edge, built-in 

security, and real-time acceleration for optimizing websites, APIs, and 

cloud applications.”

https://www.cdnetworks.com/cdnpro/

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 14 of 23 PageID #: 62
14

https://www.nginx.com/blog/load-balancing-with-nginx-plus-part-2/

“The next key point of HTTP/2 is multiplexing. Instead of sending and 

receiving responses and requests as separate streams of data over multiple 

connections, HTTP/2 multiplexes them over one stream of bytes or one 

stream of data.”

https://www.nginx.com/blog/http2-module-nginx/

collecting, by the 

gateway, selected 

network protocol 

data from the first 

MPDU, with the 

selected network 

protocol data 

including at least 

some network 

protocol data 

included in the first 

MPDU and not 

included in any of 

the plurality of 

DUs, and with the 

selected network 

protocol data 

CDNetworks collects network protocol data, such as IP addresses, from 

incoming data packets received from the internet. None of this network 

protocol data includes data from the packet payload.

“CDNetworks content delivery networks (CDN) serves thousands of large 

global enterprises, process TB-scale log data daily, including a massive 

access data and attack/defense samples. The platform’s big data and 

machine learning capabilities help detect network attack trends in realtime and automatically activates defense in advance. It also intelligently 

analyzes and identifies attacks, to model the normal behaviors of 

legitimate traffic including IP addresses, HTTP headers, cookies, and 

JavaScript snippets, etc.”

https://www.cdnetworks.com/cloud-security/flood-shield/

“Layer 4 DDoS Mitigation

CDN Pro is built upon our Edge Computing Platform. At the entry point 

of every edge Point of Presence (PoP) is a high-performance Layer 4 

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 15 of 23 PageID #: 63
15

relating exclusively 

to network 

protocols and 

including no data 

from any data 

payload(s) which 

may be present in 

the MPDU;

distributed denial-of-service (DDoS) firewall. The firewall consists of a 

group of machines that analyze incoming traffic at line speed. Based on 

regularly updated rules, the firewall rejects suspicious packets that may 

endanger services and forwards only the ‘safe’ packets to the servers 

located behind the firewall. This feature is enabled by default for all edge 

services and is transparent to all the users.

Layer 7 DDoS Mitigation

The CDN Pro platform monitors the traffic in real-time to detect unusual 

behaviors at layer 7. Once an attack is identified, defense strategies will 

be deployed in both layer 4 and layer 7 to most effectively mitigate the 

impact to normal traffic. Since its inception, CDN Pro has successfully 

handled some of the world's largest DDoS attacks with bandwidth 

reaching 1.2Tbps and request rate as high as 35Mrps.”

https://docs.cdnetworks.com/en/cdn/docs/recipes/secure-delivery

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 16 of 23 PageID #: 64
16

1. Detect abnormal traffic by Customer Monitoring System

2. Determine the content of the attack and whether or not to bypass it, and 

implement detour using BGP

3. Divert traffic to CDNetworks 

4. Traffic cleaned at Scrubbing Center 

5. Deliver normal traffic to Customer Network

https://pr.cdnetworks.co.jp/blog-ddos-attack-countermeasures-using-gre/

“CDN Pro Global Service Load Balancer (GSLB) inspects the request 

traffic based on the pre-defined layer 4 and layer 7 policies for any 

security risks. If the request does not pose a threat, GSLB routes the 

request to the edge location that best serves the request.”

See https://www.cdnetworks.com/web-performance-blog/cdn-pro-withwaf-for-web-application-protection/

applying, by the 

gateway, a first rule 

to the selected 

network protocol 

data;

CDNetworks analyzes the collected network protocol data to determine 

whether a DoS attack is occurring. 

“Layer 4 DDoS Mitigation

CDN Pro is built upon our Edge Computing Platform. At the entry point 

of every edge Point of Presence (PoP) is a high-performance Layer 4 

distributed denial-of-service (DDoS) firewall. The firewall consists of a 

group of machines that analyze incoming traffic at line speed. Based on 

End Users

Customer Rules

OWASP Policies

CDN Pro WAF Origin of Web

Applications

2. CDN Pro L4, L7 Policies

6. WAF Policies

3. Responds Cached Copy

1. Request 5. Request to WAF 7. Fetch Content

4. CDN Pro Edge Logic Control Rules

Global Edge

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 17 of 23 PageID #: 65
17

regularly updated rules, the firewall rejects suspicious packets that may 

endanger services and forwards only the ‘safe’ packets to the servers 

located behind the firewall. This feature is enabled by default for all edge 

services and is transparent to all the users.

Layer 7 DDoS Mitigation

The CDN Pro platform monitors the traffic in real-time to detect unusual 

behaviors at layer 7. Once an attack is identified, defense strategies will 

be deployed in both layer 4 and layer 7 to most effectively mitigate the 

impact to normal traffic. Since its inception, CDN Pro has successfully 

handled some of the world's largest DDoS attacks with bandwidth 

reaching 1.2Tbps and request rate as high as 35Mrps.”

https://docs.cdnetworks.com/en/cdn/docs/recipes/secure-delivery

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 18 of 23 PageID #: 66
18

1. Detect abnormal traffic by Customer Monitoring System

2. Determine the content of the attack and whether or not to bypass it, and 

implement detour using BGP

3. Divert traffic to CDNetworks 

4. Traffic cleaned at Scrubbing Center 

5. Deliver normal traffic to Customer Network

https://pr.cdnetworks.co.jp/blog-ddos-attack-countermeasures-using-gre/

“CDN Pro Global Service Load Balancer (GSLB) inspects the request 

traffic based on the pre-defined layer 4 and layer 7 policies for any 

security risks. If the request does not pose a threat, GSLB routes the 

request to the edge location that best serves the request.”

See https://www.cdnetworks.com/web-performance-blog/cdn-pro-withwaf-for-web-application-protection/

“Policies include IP/URL blacklist and whitelist, access control by IP 

address, URL, domain name.”

CDNetworks-DDoS-Product-Overview.pdf

selectively making, 

by the gateway, a 

responsive reaction 

based, at least in 

If a DoS attack is detected based on the analysis of the collected network 

protocol data, CDNetworks does not deliver potentially data packets 

directly to the customer network but, instead, re-routes suspect packets to 

a Scrubbing Center or blocks them altogether. 

End Users

Customer Rules

OWASP Policies

CDN Pro WAF Origin of Web

Applications

2. CDN Pro L4, L7 Policies

6. WAF Policies

3. Responds Cached Copy

1. Request 5. Request to WAF 7. Fetch Content

4. CDN Pro Edge Logic Control Rules

Global Edge

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 19 of 23 PageID #: 67
19

part, upon the 

application of the 

first rule to the 

selected network 

protocol data at the 

applying step; and

“Layer 4 DDoS Mitigation

CDN Pro is built upon our Edge Computing Platform. At the entry point 

of every edge Point of Presence (PoP) is a high-performance Layer 4 

distributed denial-of-service (DDoS) firewall. The firewall consists of a 

group of machines that analyze incoming traffic at line speed. Based on 

regularly updated rules, the firewall rejects suspicious packets that may 

endanger services and forwards only the ‘safe’ packets to the servers 

located behind the firewall. This feature is enabled by default for all edge 

services and is transparent to all the users.

Layer 7 DDoS Mitigation

The CDN Pro platform monitors the traffic in real-time to detect unusual 

behaviors at layer 7. Once an attack is identified, defense strategies will 

be deployed in both layer 4 and layer 7 to most effectively mitigate the 

impact to normal traffic. Since its inception, CDN Pro has successfully 

handled some of the world's largest DDoS attacks with bandwidth 

reaching 1.2Tbps and request rate as high as 35Mrps.”

https://docs.cdnetworks.com/en/cdn/docs/recipes/secure-delivery

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 20 of 23 PageID #: 68
20

1. Detect abnormal traffic by Customer Monitoring System

2. Determine the content of the attack and whether or not to bypass it, and 

implement detour using BGP

3. Divert traffic to CDNetworks 

4. Traffic cleaned at Scrubbing Center 

5. Deliver normal traffic to Customer Network

https://pr.cdnetworks.co.jp/blog-ddos-attack-countermeasures-using-gre/

“CDN Pro Global Service Load Balancer (GSLB) inspects the request 

traffic based on the pre-defined layer 4 and layer 7 policies for any 

security risks. If the request does not pose a threat, GSLB routes the 

request to the edge location that best serves the request.”

See https://www.cdnetworks.com/web-performance-blog/cdn-pro-withwaf-for-web-application-protection/

“Policies include IP/URL blacklist and whitelist, access control by IP 

address, URL, domain name.”

CDNetworks-DDoS-Product-Overview.pdf

selectively 

communicating, by 

the gateway, the 

first DU to a 

If a DoS attack is detected based on the analysis of the collected network 

protocol data, CDNetworks does not deliver potentially data packets 

directly to the customer network but, instead, re-routes suspect packets to 

a Scrubbing Center or blocks them altogether. 

End Users

Customer Rules

OWASP Policies

CDN Pro WAF Origin of Web

Applications

2. CDN Pro L4, L7 Policies

6. WAF Policies

3. Responds Cached Copy

1. Request 5. Request to WAF 7. Fetch Content

4. CDN Pro Edge Logic Control Rules

Global Edge

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 21 of 23 PageID #: 69
21

receiver-side 

connectionless 

network of the 

computer 

communication 

network system on 

condition that the 

communicating of 

the first DU does 

not conflict with the 

responsive reaction 

of the selectively 

communicating 

step.

“Layer 4 DDoS Mitigation

CDN Pro is built upon our Edge Computing Platform. At the entry point 

of every edge Point of Presence (PoP) is a high-performance Layer 4 

distributed denial-of-service (DDoS) firewall. The firewall consists of a 

group of machines that analyze incoming traffic at line speed. Based on 

regularly updated rules, the firewall rejects suspicious packets that may 

endanger services and forwards only the ‘safe’ packets to the servers 

located behind the firewall. This feature is enabled by default for all edge 

services and is transparent to all the users.

Layer 7 DDoS Mitigation

The CDN Pro platform monitors the traffic in real-time to detect unusual 

behaviors at layer 7. Once an attack is identified, defense strategies will 

be deployed in both layer 4 and layer 7 to most effectively mitigate the 

impact to normal traffic. Since its inception, CDN Pro has successfully 

handled some of the world's largest DDoS attacks with bandwidth 

reaching 1.2Tbps and request rate as high as 35Mrps.”

https://docs.cdnetworks.com/en/cdn/docs/recipes/secure-delivery

https://documents.cdnetworks.com/document/15921/appshieldhowitworks?rsr=cdnw

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 22 of 23 PageID #: 70
22

1. Detect abnormal traffic by Customer Monitoring System

2. Determine the content of the attack and whether or not to bypass it, and 

implement detour using BGP

3. Divert traffic to CDNetworks 

4. Traffic cleaned at Scrubbing Center 

5. Deliver normal traffic to Customer Network

https://pr.cdnetworks.co.jp/blog-ddos-attack-countermeasures-using-gre/

“CDN Pro Global Service Load Balancer (GSLB) inspects the request 

traffic based on the pre-defined layer 4 and layer 7 policies for any 

security risks. If the request does not pose a threat, GSLB routes the 

request to the edge location that best serves the request.”

See https://www.cdnetworks.com/web-performance-blog/cdn-pro-withwaf-for-web-application-protection/

End Users

Customer Rules

OWASP Policies

CDN Pro WAF Origin of Web

Applications

2. CDN Pro L4, L7 Policies

6. WAF Policies

3. Responds Cached Copy

1. Request 5. Request to WAF 7. Fetch Content

4. CDN Pro Edge Logic Control Rules

Global Edge

Case 2:23-cv-00233-JRG Document 1-2 Filed 05/26/23 Page 23 of 23 PageID #: 71