# US 12,120,139 B1 · System and method to protect resource allocation in stateful connection managers

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,120,139 B1
- Document ID: US12120139B1
- Status: Granted
- Kind: B1
- Application number: 18/111,476
- Filed: 2023-02-17
- Granted: 2024-10-15
- Earliest claimed: 2019-11-11
- Assignees: Volterra, Inc.
- Applicants: Volterra, Inc.
- Inventors: Devesh Mittal; Daniel Sela; Naveen Neelakanta; Anand H. Krishnan
- Web page: https://patentgrep.com/patent/US12120139B1

## CPC

- H04L 43/0817: by checking functioning
- H04L 43/0894: Packet rate
- H04L 47/286: {Time to live}
- H04L 47/827: {Aggregation of resource allocation or reservation requests}
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- H04L 63/126: {the source of the received data}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/1458: {Denial of Service}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 61/2514: between local and global IP addresses
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computing system and related method protect a computer network connection manager's resources from attempted resource attacks by extracting SrcIP and TTL values from received data packet headers. Extracted SrcIP and TTL values are analyzed to determine the probability that a received data packet is malicious. If the probability exceeds a specified threshold, resources are denied, and the packet is dropped. If the specified threshold is not exceeded, resources are allocated to the received data packet. The SrcIP reputation score, TTL value frequency, SrcIP frequency, SrcIP geo-location, and resource occupancy may all be used in computing the probability of a malicious data packet. These factors may be weighted and summed to calculate the probability of a malicious data packet.

## Claims

### Claim 1

A computing system for coupling to a computer network, the computing system having resources for processing data packets received from the computer network, the data packets having headers that include a source IP address value (SrcIP) and a Time to Live value (TTL), the computing system comprising traffic management apparatuses, client devices, or server devices, the computing system comprising memory comprising programmed instructions stored thereon and processors configured to be capable of executing the stored programmed instructions to:
receive data packets from the network and configured to extract the SrcIP value from the header of each data packet;
use the SrcIP value to look up a corresponding geo-location from which the received data packet was purportedly sent by searching a look-up table indexed by the SrcIP;
determine whether the corresponding geo-location is a country or region from which resource attacks are frequently mounted and whether a reverse path leads back to the corresponding geo-location from which the received data packet was received; and
in response to determining the corresponding geo-location is a country or region from which resource attacks are frequently mounted and that the reverse path fails to lead back to the corresponding geo-location, increase the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 2 (depends on 1)

The computing system of claim 1 wherein the processors are further configured to be capable of executing the programmed instructions stored in the memory to:
determine whether the corresponding geo-location is from an allowed geo-location by determining whether the corresponding geo-location is in an allowed geo-location list; and
in response to determining the corresponding geo-location is from an allowed geo-location, decrease the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 3 (depends on 1)

The computing system of claim 1 wherein the processors are further configured to be capable of executing the programmed instructions stored in the memory to:
monitor the amount of resources already allocated for processing received data packets that originate from a particular geo-location; and
increase the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system as the amount of resources already allocated for processing received data packets that originated from said geo-location increases.

### Claim 4 (depends on 1)

The computing system of claim 1 wherein the processors are further configured to be capable of executing the programmed instructions stored in the memory to is configured to:
extract the TTL value from the header of each data packet;
analyze the extracted SrcIP and TTL values to determine the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system by monitoring the amount of resources already allocated for processing received data packets that have a particular SrcIP value, and increasing the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system as the amount of resources already allocated for processing received data packets having the particular SrcIP value increases; and
in response to the analyzing the extracted SrcIP and TTL values, decrease the allocation of the resources of the computing system used to process a data packet as the probability that the data packet was initiated by an attacker mounting a resource attack against the computing system increases.

### Claim 5 (depends on 4)

The computing system of claim 4 wherein the processors are further configured to be capable of executing the programmed instructions stored in the memory to:
use the SrcIP value to look up a corresponding reputation score in a SrcIP address reputation database;
count the number of data packets received which have a particular TTL value, and wherein the processors are further configured to compute a TTL suspicion score derived from the number of data packets received which have the particular TTL value;
monitor the frequency of data packets received which have a particular SrcIP value, and wherein the processors are further configured to compute an SrcIP suspicion score derived from the frequency of received data packets having the particular SrcIP value;
monitor the amount of resources already allocated, and wherein the analysis logic is configured to provide a corresponding occupancy count;
scale the reputation score, TTL suspicion score, the SrcIP suspicion score, and the occupancy count by weighted scaling factors; and
add together the scaled reputation score, scaled TTL suspicion score, scaled SrcIP suspicion score, and scaled occupancy count, to provide the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 6

A method implemented by one or more computer systems, server devices, or client devices, for protecting a computing system coupled to a computer network from a resource attack by penalizing suspicious data packets without significantly penalizing legitimate data packets, the computing system having resources for processing data packets received from the computer network, the data packets having headers that include a source IP address value (SrcIP) and a Time to Live value (TTL), the method comprising steps of:
receiving data packets from the network and configured to extract the SrcIP value from the header of each data packet;
using the SrcIP value to look up a corresponding geo-location from which the received data packet was purportedly sent by searching a look-up table indexed by the SrcIP;
determining whether the corresponding geo-location is a country or region from which resource attacks are frequently mounted and whether a reverse path leads back to the corresponding geo-location from which the received data packet was received; and
in response to determining the corresponding geo-location is a country or region from which resource attacks are frequently mounted and that the reverse path fails to lead back to the corresponding geo-location, increasing the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 7 (depends on 6)

The method of claim 6 further comprising:
determining whether the corresponding geo-location is from an allowed geo-location by determining whether the corresponding geo-location is in an allowed geo-location list; and
in response to determining the corresponding geo-location is from an allowed geo-location, decreasing the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 8 (depends on 6)

The method of claim 6 further comprising:
monitoring the amount of resources already allocated for processing received data packets that originate from a particular geo-location; and
increasing the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system as the amount of resources already allocated for processing received data packets that originated from said geo-location increases.

### Claim 9 (depends on 6)

The method of claim 6 further comprising:
extracting the TTL value from the header of each data packet;
analyzing the extracted SrcIP and TTL values to determine the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system by monitoring the amount of resources already allocated for processing received data packets that have a particular SrcIP value, and increasing the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system as the amount of resources already allocated for processing received data packets having the particular SrcIP value increases; and
in response to the analyzing the extracted SrcIP and TTL values, decreasing the allocation of the resources of the computing system used to process a data packet as the probability that the data packet was initiated by an attacker mounting a resource attack against the computing system increases.

### Claim 10 (depends on 9)

The method of claim 9 further comprising:
using the SrcIP value to look up a corresponding reputation score in a SrcIP address reputation database;
counting the number of data packets received which have a particular TTL value, and computing a TTL suspicion score derived from the number of data packets received which have the particular TTL value;
monitoring the frequency of data packets received which have a particular SrcIP value, and computing an SrcIP suspicion score derived from the frequency of received data packets having the particular SrcIP value;
monitoring the amount of resources already allocated, and providing a corresponding occupancy count;
scaling the reputation score, the TTL suspicion score, the SrcIP suspicion score, and the occupancy count, by weighted scaling factors; and
adding together the scaled reputation score, the scaled TTL suspicion score, the scaled SrcIP suspicion score, and the scaled occupancy count, to provide the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 11

An apparatus, comprising memory comprising programmed instructions stored in the memory and processors configured to be capable of executing the programmed instructions stored in the memory to:
receive data packets from the network and configured to extract the SrcIP value from the header of each data packet;
use the SrcIP value to look up a corresponding geo-location from which the received data packet was purportedly sent by searching a look-up table indexed by the SrcIP;
determine whether a reverse path leads back to the corresponding geo-location from which the received data packet was received;
in response to the determination that the reverse path fails to lead back to the corresponding geo-location, increase the probability that the received data packet was initiated by an attacker mounting a resource attack against the computing system;
determine whether the corresponding geo-location is a country or region from which resource attacks are frequently mounted; and
in response to determining the corresponding geo-location is a country or region from which resource attacks are frequently mounted, increase the probability that the received data packet was initiated by the attacker mounting the resource attack against the computing system.

### Claim 12 (depends on 11)

The device as set forth in claim 11, wherein the processors are further configured to be capable of executing the programmed instructions stored in the memory to:
determine whether the corresponding geo-location is from an allowed geo-location by determining whether the corresponding geo-location is in an allowed geo-location list; and
in response to determining the corresponding geo-location is from an allowed geo-location, decrease the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 13 (depends on 11)

The device as set forth in claim 11, wherein the processors are further configured to be capable of executing the programmed instructions stored in the memory to:
monitor the amount of resources already allocated for processing received data packets that originate from a particular geo-location; and
increase the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system as the amount of resources already allocated for processing received data packets that originated from said geo-location increases.

### Claim 14 (depends on 11)

The device as set forth in claim 11, wherein the processors are further configured to be capable of executing the programmed instructions stored in the memory to:
extract the TTL value from the header of each data packet;
analyze the extracted SrcIP and TTL values to determine the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system by monitoring the amount of resources already allocated for processing received data packets that have a particular SrcIP value, and increasing the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system as the amount of resources already allocated for processing received data packets having the particular SrcIP value increases; and
in response to the analyzing the extracted SrcIP and TTL values, decrease the allocation of the resources of the computing system used to process a data packet as the probability that the data packet was initiated by an attacker mounting a resource attack against the computing system increases.

### Claim 15 (depends on 14)

The device as set forth in claim 14, wherein the processors are further configured to be capable of executing the programmed instructions stored in the memory to:
use the SrcIP value to look up a corresponding reputation score in a SrcIP address reputation database;
count the number of data packets received which have a particular TTL value, and compute a TTL suspicion score derived from the number of data packets received which have the particular TTL value;
monitor the frequency of data packets received which have a particular SrcIP value, and wherein processors are further configured to compute an SrcIP suspicion score derived from the frequency of received data packets having the particular SrcIP value;
monitor the amount of resources already allocated, and provide a corresponding occupancy count;
scale the reputation score, TTL suspicion score, the SrcIP suspicion score, and the occupancy count by weighted scaling factors; and
add together the scaled reputation score, scaled TTL suspicion score, scaled SrcIP suspicion score, and scaled occupancy count, to provide the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 16

A non-transitory computer readable medium having stored thereon instructions for managing servers comprising executable code which when executed by processors, causes the processors to:
receive data packets from the network and configured to extract the SrcIP value from the header of each data packet;
use the SrcIP value to look up a corresponding geo-location from which the received data packet was purportedly sent by searching a look-up table indexed by the SrcIP;
determine whether the corresponding geo-location is a country or region from which resource attacks are frequently mounted and whether a reverse path leads back to the corresponding geo-location from which the received data packet was received; and
in response to determining the corresponding geo-location is a country or region from which resource attacks are frequently mounted and that the reverse path fails to lead back to the corresponding geo-location, increase the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 17 (depends on 16)

The medium of claim 16, wherein the executable code which when executed by the processors, further causes the processors to:
determine whether the corresponding geo-location is from an allowed geo-location by determining whether the corresponding geo-location is in an allowed geo-location list; and
in response to determining the corresponding geo-location is from an allowed geo-location, decrease the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.

### Claim 18 (depends on 16)

The medium of claim 16, wherein the executable code which when executed by the processors, further causes the processors to:
monitor the amount of resources already allocated for processing received data packets that originate from a particular geo-location; and
increase the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system as the amount of resources already allocated for processing received data packets that originated from said geo-location increases.

### Claim 19 (depends on 16)

The medium of claim 16, wherein the executable code which when executed by the processors, further causes the processors to:
extract the TTL value from the header of each data packet;
analyze the extracted SrcIP and TTL values to determine the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system by monitoring the amount of resources already allocated for processing received data packets that have a particular SrcIP value, and increasing the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system as the amount of resources already allocated for processing received data packets having the particular SrcIP value increases; and
in response to the analyzing the extracted SrcIP and TTL values, decrease the allocation of the resources of the computing system used to process a data packet as the probability that the data packet was initiated by an attacker mounting a resource attack against the computing system increases.

### Claim 20 (depends on 19)

The medium of claim 19, wherein the executable code which when executed by the processors, further causes the processors to:
use the SrcIP value to look up a corresponding reputation score in a SrcIP address reputation database;
count the number of data packets received which have a particular TTL value, and compute a TTL suspicion score derived from the number of data packets received which have the particular TTL value;
monitor the frequency of data packets received which have a particular SrcIP value, and wherein the processors are further configured to compute an SrcIP suspicion score derived from the frequency of received data packets having the particular SrcIP value;
monitor the amount of resources already allocated, and provide a corresponding occupancy count;
scale the reputation score, TTL suspicion score, the SrcIP suspicion score, and the occupancy count by weighted scaling factors; and
add together the scaled reputation score, scaled TTL suspicion score, scaled SrcIP suspicion score, and scaled occupancy count, to provide the probability that a received data packet was initiated by an attacker mounting a resource attack against the computing system.