Mitigating automated attacks in a computer network environment

Abstract

A technique to slow down or block creation of automated attack scripts uses a detector configured to discriminate whether particular attack-like activity is a true attack, or simply a hacker “testing” an automated attack script, and then permitting any such test script to continue working (attacking) the site, albeit on a limited basis. In this manner, the hacker receives an indication that his or her automated attack script is already working. Thereafter, when the detector later detects a launch of an actual attack based on or otherwise associated with the automated attack script (previously under test), the attack fails either because the script was not a working script in the first instance, or because information learned about the script is used to adjust the site as necessary to then prepare adequately for a true attack.

What is claimed is as follows: 
     
         1 . A method to mitigate automated attacks directed to a computing platform environment, comprising:
 upon occurrence of a transaction associated with an automated script configured to initiate an actual automated attack on the computing platform environment, detecting whether the transaction is associated with testing of the automated script;   upon a detection that the transaction is associated with testing of the automated script, executing the automated script in the computing platform environment;   generating an indication that the automated script executed correctly;   thereafter, identifying a subsequent use of the automated script in the computing platform environment; and   responsive to identifying the subsequent use, blocking or mitigating operation of the automated script.   
     
     
         2 . The method as described in  claim 1  carried out as a managed service. 
     
     
         3 . The method as described in  claim 1  wherein detecting includes performing a set of one or more detections to detect whether the transaction is associated with testing of the automated script. 
     
     
         4 . The method as described in  claim 3  wherein the set of detections include one of: a transaction rate check, a user history check, an IP address/location check, a behavior check, and an analytical check. 
     
     
         5 . The method as described in  claim 4  wherein the detection is based on an aggregate analysis of the set of one or more detections. 
     
     
         6 . The method as described in  claim 5  wherein the aggregate analysis implements a statistical or machine learning algorithm. 
     
     
         7 . A computer program product in a non-transitory computer readable medium comprising computer program instructions executable in a computing platform environment by a hardware processor to:
 upon occurrence of a transaction associated with an automated script configured to initiate an actual automated attack on the computing platform environment, detect whether the transaction is associated with testing of the automated script;   upon a detection that the transaction is associated with testing of the automated script, execute the automated script in the computing platform environment;   generate an indication that the automated script executed correctly;   thereafter, identify a subsequent use of the automated script in the computing platform environment; and   responsive to identifying the subsequent use, block or mitigate operation of the automated script.   
     
     
         8 . The computer program product as described in  claim 7  wherein the computer program instructions that detect includes instructions further configured to perform a set of one or more detections to detect whether the transaction is associated with testing of the automated script. 
     
     
         9 . The computer program product as described in  claim 8  wherein the set of detections include one of: a transaction rate check, a user history check, an IP address/location check, a behavior check, and an analytical check. 
     
     
         10 . The computer program product as described in  claim 9  wherein the detection is based on an aggregate analysis of the set of one or more detections. 
     
     
         11 . The computer program product as described in  claim 10  wherein the aggregate analysis implements a statistical or machine learning algorithm.