# US 11,451,582 B2 · Detecting malicious packets in edge network devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,582 B2 - Document ID: US11451582B2 - Status: Granted - Kind: B2 - Application number: 16/850,903 - Filed: 2020-04-16 - Published: 2021-04-22 - Granted: 2022-09-20 - Earliest claimed: 2019-10-16 - Assignees: Arbor Networks, Inc. - Applicants: Arbor Networks, Inc. - Inventors: Brian St. Pierre - Web page: https://patentgrep.com/patent/US11451582B2 ## CPC - H04L 63/1458: {Denial of Service} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Detecting a Denial of Service (DoS) attack in a network by a network edge router device whereby network traffic flows from the edge router to a core router in the network. Storing DoS attack traffic information in storage associated with the edge router which receives network traffic. Determining in the edge router if a portion of the received network traffic matches at least a portion of the stored DoS attack information. Determining in the edge router an alert condition exists if a portion of the received network traffic is determined to match at least a portion of the stored DoS attack information. Send an alert signal from the edge router to an attack mitigation device if it is determined an alert condition exists causing the attack mitigation device to transition to a mitigation state for mitigating effects of a DoS attack upon the network. ## Claims ### Claim 1 A computer method for detecting a Denial of Service (DoS) attack in a network by a network edge router device whereby network traffic flows from the edge router to a core router in the network, comprising the steps: storing DoS attack traffic information in storage associated with the edge router; receiving network traffic in the edge router; determining in the edge router when a portion of the received network traffic matches at least a portion of the stored DoS attack information; determining in the edge router an alert condition exists when a portion of the received network traffic is determined to match at least a portion of the stored DoS attack information; and sending an alert signal from the edge router to an attack mitigation device when it is determined an alert condition exists causing the attack mitigation device to transition to a mitigation state for mitigating effects of a DoS attack upon the network. ### Claim 2 (depends on 1) The computer method as recited in claim 1, wherein a network management device sends the DoS attack traffic information to the edge router. ### Claim 3 (depends on 2) The computer method as recited in claim 2, wherein determining when an alert condition exists further includes: incrementing a counter in the edge router when it is determined a portion of the received network traffic matches at least a portion of the stored DoS attack information; determining when the counter exceeds a predetermined threshold value when incremented within a prescribed period of time; and applying a traffic policer in the edge router device when it is determined the counter exceeds a predetermined threshold value when incremented within the prescribed period of time. ### Claim 4 (depends on 3) The computer method as recited in claim 3, wherein determining when an alert condition exists further includes limiting the traffic rate for the received traffic when the traffic policer determined the portion of the received network traffic matching at least a portion of the stored DoS attack information exceeded a predetermined threshold rate. ### Claim 5 (depends on 2) The computer method as recited in claim 2, wherein determining when an alert condition exists further includes: incrementing a counter in the edge router associated with the portion of the received network traffic determined to match at least a portion of the stored DoS attack information; determining when the counter exceeds a predetermined threshold value when incremented within a prescribed period of time; applying a traffic policer in the edge router device when it is determined the counter exceeds a predetermined threshold value when incremented within the prescribed period of time; and determining when if a traffic rate for the received traffic exceeds a predetermined threshold rate in the traffic policer; transmitting the alert signal to the attack mitigation device when the counter exceeds a predetermined threshold value when incremented within the prescribed period of time and it is determined the traffic rate for the received traffic exceeds a predetermined threshold rate. ### Claim 6 (depends on 5) The computer method as recited in claim 5, further including limiting the traffic rate for the received traffic when the traffic policer determined the portion of the received network traffic matching at least a portion of the stored DoS attack information exceeded a predetermined threshold rate. ### Claim 7 (depends on 3) The computer method as recited in claim 3, further including, in the edge router, dropping at least a portion of the received traffic determined to match the stored attack information flowing from the edge router to the coupled core router when the counter exceeds a threshold value within the prescribed period of time. ### Claim 8 (depends on 5) The computer method as recited in claim 5, further including, in the edge router, dropping at least a portion of the received traffic determined to match the stored attack information flowing from the edge router to the coupled core router when the counter exceeds a threshold value within the prescribed period of time and the traffic rate for the received traffic is determined to exceed a predetermined threshold rate. ### Claim 9 A network edge router apparatus for detecting a Denial of Service (DoS) attack in a network, comprising: a memory, coupled to the edge router, configured to store instructions; a processor, coupled to the edge router, disposed in communication with the memory, wherein said processor upon execution of the instructions is configured to: receive and store in the memory DoS attack traffic information from a coupled network management system; receive network traffic; determine if at least a portion of the received network traffic matches at least a portion of the stored DoS attack information; determine an alert condition exists if at least a portion of the received network traffic is determined to match at least a portion of the stored DoS attack information; send an alert signal if it is determined an alert condition exists to an attack mitigation device coupled in the network causing the attack mitigation device to transition to a mitigation state for mitigating effects of a DoS attack upon the network. ### Claim 10 (depends on 9) The network edge apparatus as recited in claim 9, wherein a network management device sends the DoS attack traffic information to the edge router. ### Claim 11 (depends on 9) The network edge apparatus as recited in claim 9, wherein determining if an alert condition exists further includes: incrementing a counter in the edge router when it is determined a portion of the received network traffic matches at least a portion of the stored DoS attack information; determining if the counter exceeds a predetermined threshold value when incremented within a prescribed period of time; and applying a traffic policer in the edge router device when it is determined the counter exceeds a predetermined threshold value when incremented within the prescribed period of time. ### Claim 12 (depends on 11) The network edge apparatus as recited in claim 11, wherein determining if an alert condition exists further includes limiting the traffic rate for the received traffic if the traffic policer determined the portion of the received network traffic matching at least a portion of the stored DoS attack information exceeded a predetermined threshold rate. ### Claim 13 (depends on 9) The network edge apparatus as recited in claim 9, wherein determining if an alert condition exists further includes: incrementing a counter in the edge router associated with the portion of the received network traffic determined to match at least a portion of the stored DoS attack information; determining if the counter exceeds a predetermined threshold value when incremented within a prescribed period of time; applying a traffic policer in the edge router device when it is determined the counter exceeds a predetermined threshold value when incremented within the prescribed period of time; and determining if a traffic rate for the received traffic exceeds a predetermined threshold rate in the traffic policer; transmitting the alert signal to the attack mitigation device when the counter exceeds a predetermined threshold value when incremented within the prescribed period of time and it is determined the traffic rate for the received traffic exceeds a predetermined threshold rate. ### Claim 14 (depends on 13) The network edge apparatus as recited in claim 13, further including limiting the traffic rate for the received traffic if the traffic policer determined the portion of the received network traffic matching at least a portion of the stored DoS attack information exceeded a predetermined threshold rate. ### Claim 15 (depends on 11) The network edge apparatus as recited in claim 11, further including dropping at least a portion of the received traffic determined to match the stored attack information flowing from the edge router to the coupled core router when the counter exceeds a threshold value within the prescribed period of time. ### Claim 16 (depends on 13) The network edge apparatus as recited in claim 13, further including, in the edge router, dropping at least a portion of the received traffic determined to match the stored attack information flowing from the edge router to the coupled core router when the counter exceeds a threshold value within the prescribed period of time and the traffic rate for the received traffic is determined to exceed a predetermined threshold rate. ### Claim 17 A computer method for detecting a Denial of Service (DoS) attack in a network by a network edge router device whereby network traffic flows from the edge router to a core router in the network, comprising the steps: storing DoS attack traffic information in storage associated with the edge router; receiving network traffic in the edge router; determining in the edge router if a portion of the received network traffic matches at least a portion of the stored DoS attack information; determining in the edge router an alert condition exists if a portion of the received network traffic is determined to match at least a portion of the stored DoS attack information; incrementing a counter in the edge router associated with the portion of the received network traffic determined to match at least a portion of the stored DoS attack information; determining if the counter exceeds a predetermined threshold value when incremented within a prescribed period of time; applying a traffic policer in the edge router device when it is determined the counter exceeds a predetermined threshold value when incremented within the prescribed period of time; determining if a traffic rate for the received traffic exceeds a predetermined threshold rate in the traffic policer; transmitting the alert signal to the attack mitigation device when the counter exceeds a predetermined threshold value when incremented within the prescribed period of time and it is determined the traffic rate for the received traffic exceeds a predetermined threshold rate. ### Claim 18 (depends on 17) The computer method as recited in claim 17, further including, in the edge router, dropping at least a portion of the received traffic determined to match the stored attack information flowing from the edge router to the coupled core router when the counter exceeds a threshold value within the prescribed period of time and the traffic rate for the received traffic is determined to exceed a predetermined threshold rate. ### Claim 19 (depends on 18) The computer method as recited in claim 18, wherein a network management device sends the DoS attack traffic information to the edge router.