Handling distributed denial-of-service attacks based on connect requests

A network device, comprising:

• one or more memories;
• and
• one or more processors to:
• receive, from an endpoint device, a first synchronize packet requesting establishment of a connection;
• provide, to the endpoint device, a first synchronize acknowledgment packet acknowledging receipt of the first synchronize packet;
• receive, from the endpoint device, a first acknowledgment packet in response to the first synchronize acknowledgment packet;
• receive, from the endpoint device, a connection request for connecting with a server device;
• provide, to the server device, a second synchronize packet requesting a connection with the server device;
• receive, from the server device, a second synchronize acknowledgment packet acknowledging receipt of the second synchronize packet;
• provide, to the server device, a second acknowledgment packet in response to the second synchronize acknowledgment packet;
• provide, to the endpoint device, a connection response indicating establishment of a session between the network device and the server device;
• receive, from the endpoint device, a secure sockets layer message or a non-secure sockets layer message;
• record a network address of the endpoint device;
• and
• calculate a reputation score for the endpoint device based on whether the secure sockets layer message or the non-secure sockets layer message is received from the endpoint device and based on the network address of the endpoint device, wherein receipt of the secure sockets layer message results in a higher reputation score than receipt of the non-secure sockets layer message.

A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a network device, cause the network device to:
• receive, from an endpoint device, a first synchronize packet requesting establishment of a connection;
• provide, to the endpoint device, a first synchronize acknowledgment packet acknowledging receipt of the first synchronize packet;
• receive, from the endpoint device, a first acknowledgment packet in response to the first synchronize acknowledgment packet;
• receive, from the endpoint device, a connection request for connecting with a server device;
• provide, to the server device, a second synchronize packet requesting a connection with the server device;
• receive, from the server device, a second synchronize acknowledgment packet acknowledging receipt of the second synchronize packet;
• provide, to the server device, a second acknowledgment packet in response to the second synchronize acknowledgment packet;
• provide, to the endpoint device, a connection response indicating establishment of a session between the network device and the server device;
• receive, from the endpoint device, a non-secure sockets layer message;
• terminate sessions with the endpoint device and the server device based on receiving the non-secure sockets layer message from the endpoint device;
• and
• calculate a reputation score for the endpoint device based on receiving the non-secure sockets layer message from the endpoint device, wherein receipt of the secure sockets layer message results in a higher reputation score than receipt of the non-secure sockets layer message.