Attack mitigation in a packet-switched network

A computer-implemented method, comprising:

• applying one or more transport protocol heuristics to selective acknowledgement (SACK) messages received at a network adapter from a network node, the transport protocol heuristics identifying one or more threshold values for operational functions that are performed when processing the SACK messages;
• determining, by applying the one or more transport protocol heuristics to the SACK messages received from the network node, that at least one of the one or more threshold values for one or more of the transport protocol heuristics have been reached, wherein the determining further includes determining that the network node is attempting to acknowledge a plurality of send attempts to increase the size of a sendmap;
• and
• in response to determining that at least one of the one or more threshold values have been reached:
• identifying the network node as a security threat;
• and
• taking one or more remedial actions to mitigate the security threat associated with the identified network node.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• apply one or more transport protocol heuristics to selective acknowledgement (SACK) messages received at the network adapter from a network node, the transport protocol heuristics identifying one or more threshold values for operational functions that are performed when processing the SACK messages;
• determine, by applying the one or more transport protocol heuristics to the SACK messages received from the network node, that at least one of the one or more threshold values for one or more of the transport protocol heuristics have been reached, wherein the determining further includes determining that the network node is attempting to acknowledge a plurality of send attempts to increase the size of a sendmap;
• and
• in response to determining that at least one of the one or more threshold values have been reached:
• identify the network node as a security threat;
• and
• take one or more remedial actions to mitigate the security threat associated with the identified network node.