Computer networking with security features

A method for the prevention of malicious attack on a computing resource, via a software-defined networking (hereinafter “SDN”) application layer, the method comprising:

• placing at least one Switch Port Analyzer (hereinafter “SPAN”) port in an Open vSwitch (hereinafter “OVS”) to mirror a traffic flow of a network on a corresponding computing device;
• subsequent to an initialization of the OVS, immediately observing, by a computing system comprising at least one processor and memory, the traffic flow of the network once the traffic flow enters the network, wherein the traffic flow includes SYN messages that are exchanged between computing devices to establish Transmission Control Protocol (TCP) network connections, wherein observing traffic flow of the network in a secure mode comprises an exact string matching of the traffic flow of the network and alternatively observing traffic flow of the network in a second mode comprises a partial string matching of the traffic flow of the network;
• altering a SYN threshold value based on the observing of the traffic flow of the network, wherein the SYN threshold corresponds to a quantity of SYN messages transmitted over a period of time to differentiate between normal network behavior and malicious network behavior;
• and
• mirroring, by the computing system comprising at least one processor and memory, the traffic flow of the network, the altered SYN threshold value, or both on the corresponding computing devices within the TCP network connections.

A computer-readable memory tangibly storing instructions that,

• when executed by at least one processor, cause the at least one processor to perform operations, via a software-defined networking (hereinafter “SDN”) application layer, comprising:
• placing at least one Switch Port Analyzer (hereinafter “SPAN”) port in an Open vSwitch (hereinafter “OVS”) to mirror a traffic flow of a network on a corresponding computing device;
• subsequent to an initialization of the OVS, immediately observing the traffic flow of the network once the traffic flow enters the network, wherein the traffic flow includes SYN messages that are exchanged between computing devices to establish Transmission Control Protocol (TCP) network connections;
• altering a SYN threshold value based on the observing of the traffic flow of the network, wherein the SYN threshold corresponds to a quantity of SYN messages transmitted over a period of time to differentiate between normal network behavior and malicious network behavior;
• mirroring, by the computing system comprising at least one processor and memory, the traffic flow of the network, the altered SYN threshold value, or both on the corresponding computing devices within the TCP network connections;
• and
• determining whether there is malicious network behavior on the network based on a comparison of the SYN threshold to a metric of the SYN messages submitted to the network.