# US 11,122,075 B2 · Attack mitigation in a packet-switched network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,075 B2 - Document ID: US11122075B2 - Status: Granted - Kind: B2 - Application number: 16/576,556 - Filed: 2019-09-19 - Published: 2021-01-07 - Granted: 2021-09-14 - Earliest claimed: 2019-07-03 - Assignees: Netflix, Inc. - Applicants: Netflix, Inc. - Inventors: Randall Stewart - Web page: https://patentgrep.com/patent/US11122075B2 ## CPC - H04L 1/1867: Arrangements specially adapted for the transmitter end - H04L 63/1458: {Denial of Service} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 65/612: for unicast - H04W 12/108: Source integrity - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04L 63/166: {at the transport layer} - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 2463/141: Denial of service attacks against endpoints in a network - H04W 12/00: Security arrangements; Authentication; Protecting privacy or anonymity - H04W 12/10: Integrity - H04W 12/102: Route integrity, e.g. using trusted paths - H04W 12/30: Security of mobile devices; Security of mobile applications - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The disclosed computer-implemented method includes applying transport protocol heuristics to selective acknowledgement (SACK) messages received at a network adapter from a network node. The transport protocol heuristics identify threshold values for operational functions that are performed when processing the SACK messages. The method further includes determining, by applying the transport protocol heuristics to the SACK messages received from the network node, that the threshold values for the transport protocol heuristics have been reached. In response to determining that the threshold values have been reached, the method includes identifying the network node as a security threat and taking remedial actions to mitigate the security threat. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A network computing system, comprising: a network adapter that transmits and receives data via a transport protocol; a memory device that at least temporarily stores data received at the network adapter; a processor that processes at least some of the received data, including: applying one or more transport protocol heuristics to selective acknowledgement (SACK) messages received at the network adapter from a network node, the transport protocol heuristics identifying one or more threshold values for operational functions that are performed when processing the SACK messages; determining, by applying the one or more transport protocol heuristics to the SACK messages received from the network node, that at least one of the one or more threshold values for one or more of the transport protocol heuristics have been reached, wherein the determining further includes determining that the network node is attempting to acknowledge a plurality of send attempts to increase the size of a sendmap; and in response to determining that at least one of the one or more threshold values have been reached: identifying the network node as a security threat; and taking one or more remedial actions to mitigate the security threat associated with the identified network node. ### Claim 2 (depends on 1) The network computing system of claim 1, wherein applying the one or more transport protocol heuristics to the SACK messages includes incrementing one or more counters associated with the operational functions as the SACK messages are processed. ### Claim 3 (depends on 2) The network computing system of claim 2, wherein the counters indicate when at least one of the one or more threshold values for one or more of the transport protocol heuristics have been reached. ### Claim 4 (depends on 2) The network computing system of claim 2, wherein one or more of the counters are modified upon receiving an acknowledgement (ACK) message. ### Claim 5 (depends on 1) The network computing system of claim 1, wherein the security threat comprises an attacking node that is carrying out an attack against the network computing system. ### Claim 6 (depends on 1) The network computing system of claim 1, wherein at least one of the one or more remedial actions used to mitigate the security threat comprises ignoring at least some of the SACK messages received from the network node. ### Claim 7 (depends on 1) The network computing system of claim 1, wherein at least one of the one or more threshold values for operational functions that are performed when processing the SACK messages comprises an indication of whether an ACK position is to be moved within a sendmap. ### Claim 8 (depends on 7) The network computing system of claim 7, wherein at least one of the one or more threshold values for operational functions that are performed when processing the SACK messages comprises a measurement of how far the ACK position is to be moved within the send map. ### Claim 9 (depends on 1) The network computing system of claim 1, wherein at least one of the one or more threshold values for operational functions that are performed when processing the SACK messages comprises an indication of how many SACK messages are received within a specified time period. ### Claim 10 (depends on 1) The network computing system of claim 1, further comprising filtering the SACK messages to remove previously received SACK messages. ### Claim 11 (depends on 10) The network computing system of claim 10, wherein filtering the SACK messages further comprises removing duplicate SACK messages. ### Claim 12 (depends on 10) The network computing system of claim 10, wherein at least one of the one or more threshold values for operational functions that are performed when processing the SACK messages comprises an indication of how many SACK messages were filtered within a specified time period. ### Claim 13 A computer-implemented method, comprising: applying one or more transport protocol heuristics to selective acknowledgement (SACK) messages received at a network adapter from a network node, the transport protocol heuristics identifying one or more threshold values for operational functions that are performed when processing the SACK messages; determining, by applying the one or more transport protocol heuristics to the SACK messages received from the network node, that at least one of the one or more threshold values for one or more of the transport protocol heuristics have been reached, wherein the determining further includes determining that the network node is attempting to acknowledge a plurality of send attempts to increase the size of a sendmap; and in response to determining that at least one of the one or more threshold values have been reached: identifying the network node as a security threat; and taking one or more remedial actions to mitigate the security threat associated with the identified network node. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein applying the one or more transport protocol heuristics to the SACK messages includes incrementing one or more counters associated with the operational functions as the SACK messages are processed. ### Claim 15 (depends on 13) The computer-implemented method of claim 13, further comprising adding a decay factor to the sendmap to reduce one or more counters associated with ACK or SACK messages. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, wherein the network node is identified as a security threat while the ACK or SACK messages are being removed. ### Claim 17 (depends on 16) The computer-implemented method of claim 16, wherein upon determining that at least one of the one or more threshold values are no longer met by the network node, the network node is subsequently removed from being classified as a security threat. ### Claim 18 (depends on 13) The computer-implemented method of claim 13, wherein at least one of the one or more threshold values for operational functions that are performed when processing the SACK messages is dynamically changed based on one or more current operating conditions at the network computing system. ### Claim 19 (depends on 13) The computer-implemented method of claim 13, wherein at least one of the one or more threshold values for operational functions that are performed when processing the SACK messages is dynamically changed based on the occurrence of a specified trigger. ### Claim 20 A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to: apply one or more transport protocol heuristics to selective acknowledgement (SACK) messages received at the network adapter from a network node, the transport protocol heuristics identifying one or more threshold values for operational functions that are performed when processing the SACK messages; determine, by applying the one or more transport protocol heuristics to the SACK messages received from the network node, that at least one of the one or more threshold values for one or more of the transport protocol heuristics have been reached, wherein the determining further includes determining that the network node is attempting to acknowledge a plurality of send attempts to increase the size of a sendmap; and in response to determining that at least one of the one or more threshold values have been reached: identify the network node as a security threat; and take one or more remedial actions to mitigate the security threat associated with the identified network node.