System and method to protect resource allocation in stateful connection managers

A method implemented by one or more computer systems, server devices, or client devices, for protecting a computing system coupled to a computer network from a resource attack by penalizing suspicious data packets without significantly penalizing legitimate data packets, the computing system having resources for processing data packets received from the computer network, the data packets having headers that include a source IP address value (SrcIP) and a Time to Live value (TTL), the method comprising steps of:

• receiving data packets from the network and configured to extract the SrcIP value from the header of each data packet;
• using the SrcIP value to look up a corresponding geo-location from which the received data packet was purportedly sent by searching a look-up table indexed by the SrcIP;
• determining whether the corresponding geo-location is a country or region from which resource attacks are frequently mounted and whether a reverse path leads back to the corresponding geo-location from which the received data packet was received;
• and
• in response to determining the corresponding geo-location is a country or region from which resource attacks are frequently mounted and that the reverse path fails to lead back to the corresponding geo-location, increasing the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

An apparatus, comprising memory comprising programmed instructions stored in the memory and processors configured to be capable of executing the programmed instructions stored in the memory to:

• receive data packets from the network and configured to extract the SrcIP value from the header of each data packet;
• use the SrcIP value to look up a corresponding geo-location from which the received data packet was purportedly sent by searching a look-up table indexed by the SrcIP;
• determine whether a reverse path leads back to the corresponding geo-location from which the received data packet was received;
• in response to the determination that the reverse path fails to lead back to the corresponding geo-location, increase the probability that the received data packet was initiated by an attacker mounting a resource attack against the computing system;
• determine whether the corresponding geo-location is a country or region from which resource attacks are frequently mounted;
• and
• in response to determining the corresponding geo-location is a country or region from which resource attacks are frequently mounted, increase the probability that the received data packet was initiated by the attacker mounting the resource attack against the computing system.

A non-transitory computer readable medium having stored thereon instructions for managing servers comprising executable code which when executed by processors, causes the processors to:

• receive data packets from the network and configured to extract the SrcIP value from the header of each data packet;
• use the SrcIP value to look up a corresponding geo-location from which the received data packet was purportedly sent by searching a look-up table indexed by the SrcIP;
• determine whether the corresponding geo-location is a country or region from which resource attacks are frequently mounted and whether a reverse path leads back to the corresponding geo-location from which the received data packet was received;
• and
• in response to determining the corresponding geo-location is a country or region from which resource attacks are frequently mounted and that the reverse path fails to lead back to the corresponding geo-location, increase the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.