Detecting network packet injection

A computing device for preventing suspicious activity on a computer network, comprising:

• one or more processors;
• non-transitory memory in electronic communication with the one or more processors, wherein the non-transitory memory stores computer executable instructions that when executed by the one or more processors cause the one or more processors to perform the steps of:
• determine a first identifier of a first packet from a connection associated with network traffic, wherein the first packet is a payload bearing packet;
• calculate a first value based at least in part on a payload portion included in the first packet;
• determine a second identifier of a second packet from the connection associated with the network traffic, wherein the second packet is a second payload bearing packet;
• determine that the second identifier matches the first identifier based at least in part on a hash map associated with the connection;
• calculate a second value based at least in part on a payload portion included in the second packet;
• compare the first value with the second value;
• determine that suspicious activity is occurring on the network based at least in part on the comparison between the first and second values;
• and
• terminate the connection based at least in part on determining that the second identifier matches the first identifier, and the first value and the second value do not match.

A non-transitory computer-readable storage medium storing computer executable instructions that when executed by one or more processors cause the one or more processors to perform the steps of:

• determine a first identifier of a first packet from a connection associated with network traffic, wherein the first packet is a payload bearing packet;
• calculate a first value based at least in part on a payload portion included in the first packet;
• determine a second identifier of a second packet from the connection associated with the network traffic, wherein the second packet is a second payload bearing packet;
• determine that the second identifier matches the first identifier based at least in part on a hash map associated with the connection;
• calculate a second value based at least in part on a payload portion included in the second packet;
• compare the first value with the second value;
• determine that suspicious activity is occurring on the network based at least in part on the comparison between the first and second values;
• and
• terminate the connection based at least in part on determining that the second identifier matches the first identifier, and the first value and the second value do not match.