# US 12,003,530 B2 · Suppressing virus propagation in a local area network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,530 B2
- Document ID: US12003530B2
- Status: Granted
- Kind: B2
- Application number: 17/151,034
- Filed: 2021-01-15
- Published: 2021-07-22
- Granted: 2024-06-04
- Earliest claimed: 2020-01-17
- Assignees: Hangzhou DPtech Technologies Co., Ltd.
- Applicants: Hangzhou DPtech Technologies Co., Ltd.
- Inventors: Futao Wang
- Web page: https://patentgrep.com/patent/US12003530B2

## CPC

- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
- H04L 61/5038: for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/0263: {Rule management}
- H04L 63/101: {Access control lists [ACL]}
- H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present application provides a method and apparatus for suppressing the spread of viruses in a local area network. The method includes determining, in response to receiving a first service packet initiated by a target terminal, whether a destination port carried in the first service packet indicates one of the preset risky ports; determining, in response to that the destination port indicates one of the preset risky ports, whether a number of interacting terminals in the LAN that have performed ARP interaction with the target terminal reaches a first preset threshold; and in response to that the number of interacting terminals reaches the first preset threshold, providing protection to the target terminal so to suppress virus propagation in the LAN.

## Claims

### Claim 1

A method for suppressing virus propagation in a local area network (LAN), being applicable to a forwarding device, comprising:
in response to receiving a first service packet initiated by a target terminal, determining whether a destination port carried in the first service packet indicates one of the preset risky ports; wherein the first service packet corresponds to a first one of service packets sent to other terminal by the target terminal immediately after acquiring a media access control (MAC) address of the other terminal by performing an address resolution protocol (ARP) interaction with the other terminal; in response to that the destination port carried indicates one of the preset risky ports, determining whether a number of interacting terminals in the LAN that have performed ARP interaction with the target terminal reaches a first preset threshold;
in response to that the number of interacting terminals reaches the first preset threshold, providing protection to the target terminal so to suppress virus propagation in the LAN, the method further comprising: in response to that the destination port indicates one of the preset risky ports, updating an abnormal packet reception time maintained by the forwarding device; in response to receiving the ARP packet sent by the target terminal, determining whether the number of interacting terminals reaches the first preset threshold;
in response to that the number of interacting terminals reaches the first preset threshold, determining whether a difference between a current time and the abnormal packet reception time is less than a preset time threshold, wherein the current time corresponds to a time when the number of interacting terminals reaches the first preset threshold, the abnormal packet reception time corresponds to the most recent time when an abnormal packet initiated by the target terminal is received by the forwarding device, and the abnormal packet is a first service message with a preset risky port as a destination port;
in response to that the difference between the current time and the abnormal packet reception time is less than the preset time threshold, providing protection to the target terminal to suppress virus propagation in the LAN,
wherein providing protection to the target terminal to suppress virus propagation in the LAN comprises:
determining whether a number of abnormal terminal relationships corresponding to the target terminal reaches a second preset threshold, wherein for one of the number of abnormal terminal relationships, the target terminal performs interaction with other terminal in the LAN by sending a first service packet of which a destination port belongs to preset risky ports, and
in response to that the number of abnormal terminal relationships reaches the second preset threshold, providing protection to the target terminal so to suppress virus propagation in the LAN,
wherein providing protection to the target terminal to suppress virus propagation in the LAN further comprises:
determining whether a number of first terminals reaches a third preset threshold, wherein the number of first terminals are terminals in the number of interacting terminals of which Internet protocol (IP) addresses are consecutive; and
in response to that the number of first terminals reaches the third preset threshold, providing protection to the target terminal to suppress virus propagation in the LAN.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
in response to receiving the ARP packet initiated by the target terminal, updating the number of interacting terminals based on the ARP packet.

### Claim 3 (depends on 2)

The method of claim 2, wherein the ARP packet comprises:
an ARP request packet and/or an ARP response packet.

### Claim 4 (depends on 1)

The method of claim 1, wherein the first service packet comprises:
a transmission control protocol (TCP) packet; and/or
a user datagram protocol (UDP) packet.

### Claim 5

A method for suppressing virus propagation in a local area network (LAN), being applicable to a forwarding device, comprising:
in response to receiving an address resolution protocol (ARP) packet initiated by a target terminal, determining whether a number of interacting terminals in the LAN that have performed ARP interaction with the target terminal reaches a first preset threshold;
in response to that the number of interacting terminals reaches the first preset threshold, determining whether a difference between a current time and an abnormal packet reception time maintained by the forwarding device is less than a preset time threshold, wherein the current time corresponds to a time when the number of interacting terminals reaches the first preset threshold, the abnormal packet reception time corresponds to the most recent time when an abnormal packet initiated by the target terminal is received by the forwarding device, and the abnormal packet is a first service message with a preset risky port as a destination port;
in response to that the difference between the current time and the abnormal packet reception time is less than the preset time threshold, providing protection to the target terminal to suppress virus propagation in the LAN,
wherein providing protection to the target terminal to suppress virus propagation in the LAN comprises:
determining whether a number of abnormal terminal relationships corresponding to the target terminal reaches a second preset threshold, wherein for one of the number of abnormal terminal relationships, the target terminal performs interaction with other terminal in the LAN by sending a first service packet of which a destination port belongs to preset risky ports, and
in response to that the number of abnormal terminal relationships reaches the second preset threshold, providing protection to the target terminal so to suppress virus propagation in the LAN,
wherein providing protection to the target terminal to suppress virus propagation in the LAN further comprises:
determining whether a number of first terminals reaches a third preset threshold, wherein the number of first terminals are terminals in the number of interacting terminals of which Internet protocol (IP) addresses are consecutive; and
in response to that the number of first terminals reaches the third preset threshold, providing protection to the target terminal to suppress virus propagation in the LAN.

### Claim 6 (depends on 5)

The method of claim 5, further comprising:
updating the number of interacting terminals based on the ARP packet, wherein the ARP packet comprises: an ARP request packet; and/or an ARP response packet.

### Claim 7 (depends on 5)

A forwarding device in a LAN storing program instructions to perform the method of claim 5, comprising:
a processor; and
a memory.

### Claim 8

A forwarding device in a LAN, comprising:
a processor;
a memory for storing program instructions that are executable by the processor to perform operations comprising:
in response to receiving a first service packet, determining whether a destination port carried in the first service packet indicates one of the preset risky ports;
wherein the first service packet corresponds to a first one of service packets sent to other terminal by the target terminal immediately after acquiring a media access control (MAC) address of the other terminal by performing an address resolution protocol (ARP) interaction with the other terminal;
in response to that the destination port indicates one of the preset risky ports, determining whether a number of interacting terminals in the LAN that have performed ARP interaction with the target terminal reaches a first preset threshold;
in response to that the number of interacting terminals reaches the first preset threshold, providing protection to the target terminal so to suppress virus propagation in the LAN,
the operations further comprising:
in response to that the destination port indicates one of the preset risky ports, updating an abnormal packet reception time maintained by the forwarding device;
in response to receiving the ARP packet sent by the target terminal, determining whether the number of interacting terminals reaches the first preset threshold;
in response to that the number of interacting terminals reaches the first preset threshold, determining whether a difference between a current time and the abnormal packet reception time is less than a preset time threshold, wherein the current time corresponds to a time when the number of interacting terminals reaches the first preset threshold, the abnormal packet reception time corresponds to the most recent time when an abnormal packet initiated by the target terminal is received by the forwarding device, and the abnormal packet is a first service message with a preset risky port as a destination port;
in response to that the difference between the current time and the abnormal packet reception time is less than the preset time threshold, providing protection to the target terminal to suppress virus propagation in the LAN,
wherein providing protection to the target terminal to suppress virus propagation in the LAN comprises:
determining whether a number of abnormal terminal relationships corresponding to the target terminal reaches a second preset threshold, wherein for one of the number of abnormal terminal relationships, the target terminal performs interaction with other terminal in the LAN by sending a first service packet of which a destination port belongs to preset risky ports, and
in response to that the number of abnormal terminal relationships reaches the second preset threshold, providing protection to the target terminal so to suppress virus propagation in the LAN,
wherein providing protection to the target terminal to suppress virus propagation in the LAN further comprises:
determining whether a number of first terminals reaches a third preset threshold, wherein the number of first terminals are terminals in the number of interacting terminals of which Internet protocol (IP) addresses are consecutive; and
in response to that the number of first terminals reaches the third preset threshold, providing protection to the target terminal to suppress virus propagation in the LAN.

### Claim 9 (depends on 8)

The forwarding device of claim 8, wherein the operations further comprise:
in response to receiving the ARP packet initiated by the target terminal, updating the number of interacting terminals based on the ARP packet.

### Claim 10 (depends on 8)

The forwarding device of claim 8, wherein the ARP packet comprises:
an ARP request packet and/or an ARP response packet.

### Claim 11 (depends on 8)

The forwarding device of claim 8, wherein the first service packet comprises:
a transmission control protocol (TCP) packet; and/or
a user datagram protocol (UDP) packet.