# US 12,113,821 B2 · Computer networking with security features > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,821 B2 - Document ID: US12113821B2 - Status: Granted - Kind: B2 - Application number: 18/297,111 - Filed: 2023-04-07 - Published: 2023-08-10 - Granted: 2024-10-08 - Earliest claimed: 2020-02-03 - Assignees: University of South Florida - Applicants: University of South Florida - Inventors: Mohamed Rahouti; Kaiqi Xiong - Web page: https://patentgrep.com/patent/US12113821B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Described herein relates to a system and method for the prevention of a malicious attack on a computing resource. In embodiments, the system may comprise the following, including but not limited to: (1) at least one processor; and (2) computer memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform operations including: (a) observing traffic flow of a network; (b) altering a SYN threshold value based on the observing of the traffic flow of the network; (c) comparing a metric of SYN messages submitted to the network; and (d) based on the comparison of the metric of SYN messages submitted, selectively engaging corrective action with the network. ## Claims ### Claim 1 A system for preventing malicious attacks on a computing resource, via a software-defined networking (hereinafter “SDN”) application layer, the system comprising: at least one processor; computer memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform user-space operations in a user-space and to perform kernel operations in a kernel-space different from the user-space, the kernel-space operations comprising: placing at least one Switch Port Analyzer (hereinafter “SPAN”) port in an Open vSwitch (hereinafter “OVS”) to mirror a traffic flow of a network on a corresponding computing device; subsequent to an initialization of the OVS, immediately observing the traffic flow of the network once the traffic flow enters the network, wherein the traffic flow includes SYN messages that are exchanged between computing devices to establish Transmission Control Protocol (TCP) network connections; and altering a SYN threshold value based on the observing of the traffic flow of the network, wherein the SYN threshold corresponds to a quantity of SYN messages transmitted over a period of time to differentiate between normal network behavior and malicious network behavior. ### Claim 2 (depends on 1) The system of claim 1, wherein the kernel-space operations further comprises the step of: determining whether there is malicious network behavior on the network based on a comparison of the SYN threshold to a metric of the SYN messages submitted to the network. ### Claim 3 (depends on 2) The system of claim 2, wherein after determining whether there is malicious network behavior on the network, the kernel-space operations further comprises the step of: in response to determining that there is malicious network behavior on the network, selectively engaging, by the computing system, corrective action with the network. ### Claim 4 (depends on 1) The system of claim 1, wherein the corrective action comprises at least one of the group comprising a direct-prevention action, an indirect-prevention action, and a non-prevention action. ### Claim 5 (depends on 1) The system of claim 1, wherein altering the SYN threshold value based on the observing of the traffic flow of the network comprises selectively: linearly increasing the SYN threshold; and faster-than-linearly decreasing the SYN threshold. ### Claim 6 (depends on 1) The system of claim 1, wherein altering the SYN threshold value based on observing of the traffic flow of the network comprises altering the SYN threshold according to an additive-increase/multiplicative-decrease scheme. ### Claim 7 (depends on 1) The system of claim 1, wherein observing traffic flow of a network comprises accessing flow-tables of switches of the network. ### Claim 8 (depends on 1) The system of claim 1, wherein observing traffic flow of a network comprises accessing packet headers to identify SYN messages. ### Claim 9 A method for the prevention of malicious attack on a computing resource, via a software-defined networking (hereinafter “SDN”) application layer, the method comprising: placing at least one Switch Port Analyzer (hereinafter “SPAN”) port in an Open vSwitch (hereinafter “OVS”) to mirror a traffic flow of a network on a corresponding computing device; subsequent to an initialization of the OVS, immediately observing, by a computing system comprising at least one processor and memory, the traffic flow of the network once the traffic flow enters the network, wherein the traffic flow includes SYN messages that are exchanged between computing devices to establish Transmission Control Protocol (TCP) network connections, wherein observing traffic flow of the network in a secure mode comprises an exact string matching of the traffic flow of the network and alternatively observing traffic flow of the network in a second mode comprises a partial string matching of the traffic flow of the network; altering a SYN threshold value based on the observing of the traffic flow of the network, wherein the SYN threshold corresponds to a quantity of SYN messages transmitted over a period of time to differentiate between normal network behavior and malicious network behavior; and mirroring, by the computing system comprising at least one processor and memory, the traffic flow of the network, the altered SYN threshold value, or both on the corresponding computing devices within the TCP network connections. ### Claim 10 (depends on 9) The method of claim 9, wherein the corrective action comprises at least one of the group comprising a direct-prevention action, an indirect-prevention action, and a non-prevention action. ### Claim 11 (depends on 9) The method of claim 9, wherein altering the SYN threshold value based on the observing of the traffic flow of the network comprises selectively: linearly increasing the SYN threshold; and faster-than-linearly decreasing the SYN threshold. ### Claim 12 (depends on 9) The method of claim 9, wherein altering the SYN threshold value based on the observing of the traffic flow of the network comprises altering the SYN threshold according to an additive-increase/multiplicative-decrease scheme. ### Claim 13 (depends on 9) The method of claim 9, wherein observing traffic flow of a network comprises accessing flow-tables of switches of the network. ### Claim 14 (depends on 9) The method of claim 9, wherein observing traffic flow of a network comprises accessing packet headers to identify SYN messages. ### Claim 15 A computer-readable memory tangibly storing instructions that, when executed by at least one processor, cause the at least one processor to perform operations, via a software-defined networking (hereinafter “SDN”) application layer, comprising: placing at least one Switch Port Analyzer (hereinafter “SPAN”) port in an Open vSwitch (hereinafter “OVS”) to mirror a traffic flow of a network on a corresponding computing device; subsequent to an initialization of the OVS, immediately observing the traffic flow of the network once the traffic flow enters the network, wherein the traffic flow includes SYN messages that are exchanged between computing devices to establish Transmission Control Protocol (TCP) network connections; altering a SYN threshold value based on the observing of the traffic flow of the network, wherein the SYN threshold corresponds to a quantity of SYN messages transmitted over a period of time to differentiate between normal network behavior and malicious network behavior; mirroring, by the computing system comprising at least one processor and memory, the traffic flow of the network, the altered SYN threshold value, or both on the corresponding computing devices within the TCP network connections; and determining whether there is malicious network behavior on the network based on a comparison of the SYN threshold to a metric of the SYN messages submitted to the network. ### Claim 16 (depends on 15) The computer-readable memory of claim 15, wherein the corrective action comprises at least one of the group comprising a direct-prevention action, an indirect-prevention action, and a non-prevention action. ### Claim 17 (depends on 15) The computer-readable memory of claim 15, wherein altering the SYN threshold value based on the observing of the traffic flow of the network comprises selectively: linearly increasing the SYN threshold; and faster-than-linearly decreasing the SYN threshold. ### Claim 18 (depends on 15) The computer-readable memory of claim 15, wherein altering the SYN threshold value based on the observing of the traffic flow of the network comprises altering the SYN threshold according to an additive-increase/multiplicative-decrease scheme. ### Claim 19 (depends on 15) The computer-readable memory of claim 15, wherein observing traffic flow of the network in a secure mode comprises an exact string matching of the traffic flow of the network and alternatively observing traffic flow of the network in a second mode comprises a partial string matching of the traffic flow of the network. ### Claim 20 (depends on 15) The computer-readable memory of claim 15, wherein the operations further comprise the step of: after determining that there is malicious network behavior on the network, selectively engaging corrective action with the network.