# US 11,122,077 B2 · Identification of attack flows in a multi-tier network topology > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,077 B2 - Document ID: US11122077B2 - Status: Granted - Kind: B2 - Application number: 16/742,465 - Filed: 2020-01-14 - Published: 2020-05-14 - Granted: 2021-09-14 - Earliest claimed: 2017-10-18 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Chih-Hung Chou; Cheng-ta Lee; Yin Lee; Chun-Shuo Lin - Web page: https://patentgrep.com/patent/US11122077B2 ## CPC - H04L 63/1458: {Denial of Service} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments can provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for network protection, the method comprising determining, by the processor, if an incoming connection comprising one or more packets has a false latency larger than a trigger latency; determining, by the processor, if an attack is currently in progress; and if the attack is in progress, injecting, by the processor, at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency. ## Claims ### Claim 1 A computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for network protection, the method comprising: calculating, by the processor, a latency distribution of one or more connections to each IP address in a network to obtain a maximum latency of the latency distribution; determining, by the processor, whether an incoming connection comprising one or more packets has a latency larger than a trigger latency, wherein the trigger latency is at least two times as much as the maximum latency; determining, by the processor, whether an attack is currently in progress; and when the attack is in progress, injecting, by the processor, at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency that is the same as the trigger latency. ### Claim 2 (depends on 1) The method as recited in claim 1, when the latency in the incoming connection is larger than the trigger latency, reporting, by the processor, the incoming connection as a suspicious connection. ### Claim 3 (depends on 2) The method as recited in claim 2, further comprising: updating, by the processor, the maximum latency based upon one or more reported suspicious connections. ### Claim 4 (depends on 1) The method as recited in claim 1, further comprising: generating, by the processor, an abnormal connection having an abnormal latency after injecting the false latency. ### Claim 5 (depends on 4) The method as recited in claim 4, further comprising: detecting, by the processor, the abnormal connection having the abnormal latency; and performing, by the processor, at least one of quarantining the abnormal connection, resetting the abnormal connection, redirecting the abnormal connection to a honeypot, or providing further information to an event collector. ### Claim 6 (depends on 1) The method as recited in claim 1, further comprising: determining, by the processor, whether to propagate each of the one or more connections into the network; determining, by the processor, whether the system is able to propagate each of the one or more connections, comprising: determining, by the processor, a last period of time a previous connection was propagated; comparing, by the processor, the last period of time the previous connection was propagated against a predetermined delay time; when the last period of time the previous connection was propagated exceeds the predetermined delay time, allowing, by the processor, the connection to propagate into the network. ### Claim 7 (depends on 6) The method as recited in claim 6, further comprising: adjusting, by the processor, the false latency based upon the predetermined delay time. ### Claim 8 A computer program product for providing network protection, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to: calculate a latency distribution of one or more connections to each IP address in a network to obtain a maximum latency of the latency distribution; determine whether an incoming connection comprising one or more packets has a latency larger than a trigger latency, wherein the trigger latency is at least two times as much as the maximum latency; determine whether an attack is currently in progress; and when the attack is in progress, inject at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency that is the same as the trigger latency. ### Claim 9 (depends on 8) The computer program product as recited in claim 8, the processor further configured to: when the latency in the incoming connection is larger than the trigger latency, report the incoming connection as a suspicious connection. ### Claim 10 (depends on 9) The computer program product as recited in claim 9, the processor further configured to: update the maximum latency based upon one or more reported suspicious connections. ### Claim 11 (depends on 8) The computer program product as recited in claim 8, the processor further configured to: generate an abnormal connection having an abnormal latency after injecting the false latency. ### Claim 12 (depends on 11) The computer program product as recited in claim 11, the processor further configured to: detect the abnormal connection having the abnormal latency; and perform at least one of quarantining the abnormal connection, resetting the abnormal connection, redirecting the abnormal connection to a honeypot, or providing further information to an event collector. ### Claim 13 A system for providing network protection, comprising: a processor coupled to a memory, configured to: calculate a latency distribution of one or more connections to each IP address in a network to obtain a maximum latency of the latency distribution; determine whether an incoming connection comprising one or more packets has a latency larger than a trigger latency, wherein the trigger latency is at least two times as much as the maximum latency; determine whether an attack is currently in progress; and when the attack is in progress, inject at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency that is the same as the trigger latency. ### Claim 14 (depends on 13) The system as recited in claim 13, the processor further configured to: when the latency in the incoming connection is larger than the trigger latency, report the incoming connection as a suspicious connection. ### Claim 15 (depends on 13) The system as recited in claim 13, the processor further configured to: generate an abnormal connection having an abnormal latency after injecting the false latency. ### Claim 16 (depends on 15) The system as recited in claim 15, the processor further configured to: detect the abnormal connection having the abnormal latency; and perform at least one of quarantining the abnormal connection, resetting the abnormal connection, redirecting the abnormal connection to a honeypot, or providing further information to an event collector. ### Claim 17 (depends on 13) The system as recited in claim 13, the processor further configured to: determine whether to propagate each of the one or more connections into the network; determine whether the system is able to propagate each of the one or more connections, comprising: determine a last period of time a previous connection was propagated; compare the last period of time the previous connection was propagated against a predetermined delay time; when the last period of time the previous connection was propagated exceeds the predetermined delay time, allow the connection to propagate into the network.