TECHNICAL BACKGROUND

Web servers that provide web services are often subject to automated attacks, such as using stolen credentials to fraudulently access the service, brute-force attacks that try several username and password combinations to gain access, registering fake accounts, scraping websites to harvest web data, and others. Such velocity attacks typically require a large number of transactions with the web service in a very short period of time, and commonly used web browsers are prohibitively slow for such large-scale and high-speed communications. Instead, attackers use a wide variety of attack tools, ranging from simple shell scripts to sophisticated custom tools designed to speed up transactions.

Various types of network security devices work to protect web services and their components from being attacked by malicious actors, such as firewalls, intrusion prevention systems, and the like. Such devices inspect network traffic at varying degrees of depth, typically by matching incoming traffic data with a library of patterns and network protocol analyzers. Security researchers typically update this pattern library continuously based on analysis of malware behavior at the network level. The larger the set of patterns and protocol analyzers, the longer it takes for network security devices to inspect network traffic. Consequently, this screening process introduces latency in the overall communication between the end user and the web service, which negatively impacts the user experience. As a result, security devices often compromise on the depth of detection in order to minimize the time taken to inspect network traffic.

OVERVIEW

Provided herein are systems, methods, and software to facilitate network security analysis and attack response. In at least one implementation, a passive analysis system receives a copy of network traffic, performs deep analysis on the copy of network traffic, and generates security data points based on the deep analysis. The passive analysis system then provides the security data points to an active inline security device, wherein the active inline security device compares incoming network traffic to the security data points to detect security events.

This Overview is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. It may be understood that this Overview is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

