Polymorphic security policy action

Abstract

In one embodiment, a method of improving the security of a computing device comprises using a computing device that has received one or more messages that have been determined as unauthorized, obtaining a plurality of state data values from one or more of the computing device, the one or more messages, and a second computer; before admitting the one or more messages to a data communications network that the computing device is configured to protect: using the computing device and pseudo-random selection logic, based on the state data values, pseudo-randomly selecting a particular policy action from among a plurality of different stored policy actions; using the computing device, acting upon the one or more messages using the particular policy action; wherein the method is performed using one or more computing devices.

What is claimed is: 
     
         1 . A method of improving the security of a computing device, comprising:
 using a computing device that has received one or more messages that have been determined as unauthorized, obtaining a plurality of state data values from one or more of: the computing device, the one or more messages, and a second computer;   before admitting the one or more messages to a data communications network that the computing device is configured to protect:   using the computing device and pseudo-random selection logic, based on the state data values, pseudo-randomly selecting a particular policy action from among a plurality of different stored policy actions, wherein each of the policy actions defines a different procedure to follow once an attack has been identified; and   using the computing device, acting upon the one or more messages using the particular policy action.   
     
     
         2 . The method of  claim 1  wherein the plurality of different policy actions comprise any two or more of: pass, drop request, drop request and close connection, redirect to an error page, inject cookie, inject one or more fields within a payload, block network address, block application user, blacklist network address. 
     
     
         3 . The method of  claim 1  wherein the plurality of state data values comprise any two or more of: system time on the computing device; system load on the computing device; attack severity level; source network address. 
     
     
         4 . The method of  claim 1  further comprising: performing the pseudo-randomly selecting only during a particular limited time period that is defined in stored schedule data. 
     
     
         5 . The method of  claim 1  wherein the state data values comprise one or more attributes of the one or more messages, and one or more operating values indicating operating characteristics of the computing device. 
     
     
         6 . The method as recited in any of  claim 1  or  5 , comprising:
 using hash value generating logic, generating a hash value that is based upon the state data values; and 
 using the pseudo-random selection logic, using the hash value as an index into a list of stored different policy actions, pseudo-randomly selecting a particular policy action from among the plurality of policy actions. 
 
     
     
         7 . The method of  claim 1 , further comprising:
 determining that the state data values match a particular policy rule from among a plurality of different policy rules;   determining that the particular policy rule corresponds to a policy action that includes a marking specifying polymorphic treatment; and   using the pseudo-random selection logic, pseudo-randomly selecting a second particular policy action.   
     
     
         8 . The method of  claim 1  further comprising:
 determining that the state data values match a particular policy rule from among a plurality of different policy rules; 
 determining that the particular policy rule corresponds to a particular limited time period that is defined in stored schedule data; and 
 performing the pseudo-randomly selecting only during the particular limited time period. 
 
     
     
         9 . An electronic digital network security device having improved security and comprising:
 one or more processors;   one or more first network interfaces that are configured to couple to a client computer;   one or more second network interfaces that are coupled to a server computer that the security device is configured to protect from attack;   one or more non-transitory computer-readable storage media coupled to the one or more processors and storing one or more sequences of instructions which when executed by the one or more processors cause performing:   receiving one or more messages that are determined as unauthorized;   obtaining a plurality of state data values from one or more of the security device, the one or more messages, and a second computer;   before providing the one or more messages to the server computer:   using pseudo-random selection logic, based on the state data values, pseudo-randomly selecting a particular policy action from among a plurality of different stored policy actions, wherein each of the policy actions defines a different procedure to follow once an attack has been identified; and   acting upon the one or more messages using the particular policy action.   
     
     
         10 . The device of  claim 9  wherein the plurality of different policy actions comprise any two or more of: pass, drop request, drop request and close connection, redirect to an error page, inject cookie, block network address, block application user, whitelist network address, blacklist network address. 
     
     
         11 . The device of  claim 9  wherein the plurality of data values comprise any two or more of: system time on the computing device; system load on the computing device; attack severity level; source network address. 
     
     
         12 . The device of  claim 9 , wherein the storage media further comprise sequences of instructions which when executed cause performing the pseudo-randomly selecting only during a particular limited time period that is defined in stored schedule data. 
     
     
         13 . The device of  claim 9  wherein the state data values comprise one or more attributes of the one or more messages, and one or more operating values indicating operating characteristics of the computing device. 
     
     
         14 . The device of  claim 9 , wherein the storage media further comprise sequences of instructions which when executed cause:
 using hash value generating logic, generating a hash value that is based upon the state data values; and   using the pseudo-random selection logic, using the hash value as an index into a list of stored different policy actions, pseudo-randomly selecting a particular policy action from among the plurality of policy actions.   
     
     
         15 . The device of  claim 9 , wherein the storage media further comprise sequences of instructions which when executed cause:
 determining that the state data values match a particular policy rule from among a plurality of different policy rules;   determining that the particular policy rule corresponds to a particular policy action that includes a marking specifying polymorphic treatment; and   using the pseudo-random selection logic, pseudo-randomly selecting a second particular policy action.   
     
     
         16 . The device of  claim 9 , wherein the storage media further comprise sequences of instructions which when executed cause:
 determining that the state data values match a particular policy rule from among a plurality of different policy rules;   determining that the particular policy rule corresponds to a particular limited time period that is defined in stored schedule data; and   performing the pseudo-randomly selecting only during the particular limited time period.   
     
     
         17 . A method of improving the security of a computing device comprising:
 using an electronic digital security device, detecting an attack represented in one or more messages received at the security device;   before admitting the one or more messages to a network that the security device protects, obtaining one or more first data values relating to then-current state of the security device, and one or more second data values from the one or more messages;   using a pseudo-random mapping function, pseudo-randomly mapping a combination of the first data values and the second data values to a particular policy action from among a plurality of policy actions, wherein each of the policy actions defines a different procedure to follow once an attack has been identified; and   applying the particular policy action to the one or more messages.   
     
     
         18 . The method of  claim 17  wherein the plurality of different policy actions comprise any two or more of: pass, drop request, drop request and close connection, redirect to an error page, inject cookie, block network address, block application user, whitelist network address, blacklist network address. 
     
     
         19 . The method of  claim 17  further comprising: performing the pseudo-randomly selecting only during a particular limited time period that is defined in stored schedule data. 
     
     
         20 . The method of  claim 17  comprising:
 using hash value generating logic, generating a hash value that is based upon the first data values and the second data values; and 
 using the pseudo-random selection logic, using the hash value as an index into a list of stored different policy actions, pseudo-randomly selecting a particular policy action from among the plurality of policy actions. 
 
     
     
         21 . The method of  claim 17  further comprising:
 determining the attack corresponds to a particular policy rule of a plurality of different policy rules; 
 determining the particular policy rule corresponds to a particular policy action that includes a marking specifying polymorphic treatment; and 
 using the pseudo-random selection logic, pseudo-randomly selecting a second particular policy action from among the plurality of policy actions. 
 
     
     
         22 . The method of  claim 17  further comprising:
 determining that the attack corresponds to a particular policy rule from among a plurality of different policy rules; 
 determining that the particular policy rule corresponds to a particular limited time period that is defined in stored schedule data; and 
 performing the pseudo-randomly selecting only during the particular limited time period.