Detecting randomness in computer network traffic
AssigneeInternational Business Machines Corporation
InventorsClark Debs Jeffries, Wuchieh James Jong, Grayson Warren Randall, Ken Van Vu
Life of this patent
Estimating the term…
Abstract
A method, system and computer program product for detecting denial-of-service attacks. The randomness in the Internet Protocol (IP) source addresses of transmitted IP packets may be detected by performing a hash function on the IP source addresses thereby generating one or more different hash values. If a high number of different hash values were generated for a small number of IP packets evaluated, then random IP source addresses may be detected. By detecting random source IP addresses, a denial-of-service attack may be detected.
Claims20
A method for detecting a denial-of-service attack comprising the steps of:
- receiving a packet of data to be forwarded to another network;
- performing a hash function on a source address of said packet of data generating a hash value;
- and
- determining a number of different hash values generated from performing said hash function on source addresses of a predetermined number of packets to be forwarded to another network, wherein if said number of different hash values is greater than or equal to a predetermined value then the method further comprises the step of:
- determining if said predetermined number of packets is at or below a threshold, wherein if said predetermined number of packets is at or below said threshold then said denial-of-service attack is detected.
A computer program product embodied in a machine readable medium for detecting a denial-of-service attack comprising the programming steps of:
- receiving a packet of data to be forwarded to another network;
- performing a hash function on a source address of said packet of data generating a hash value;
- and
- determining a number of different hash values generated from performing said hash function on source addresses of a predetermined number of packets to be forwarded to another network, wherein if said number of different hash values is greater than or equal to a predetermined value then the computer program product further comprises the programming step of:
- determining if said predetermined number of packets is at or below a threshold, wherein if said predetermined number of packets is at or below said threshold then said denial-of-service attack is detected.
A system, comprising:
- a memory unit operable for storing a computer program operable for detecting a denial-of-service attack;
- and
- a processor coupled to said memory unit, wherein said processor, responsive to said computer program, comprises:
- circuitry operable for receiving a packet of data to be forwarded to another network;
- circuitry operable for performing a hash function on a source address of said packet of data generating a hash value;
- and
- circuitry operable for determining a number of different hash values generated from performing said hash function on source addresses of a predetermined number of packets to be forwarded to another network, wherein if said number of different hash values is greater than or equal to a predetermined value then said processor further comprises:
- circuitry operable for determining if said predetermined number of packets is at or below a threshold, wherein if said predetermined number of packets is at or below said threshold then said denial-of-service attack is dedected.
A system, comprising:
- a router coupled to an external network, wherein said router is configured to forward packets of data issued from one or more clients to said external network, wherein said router comprises:
- a memory unit operable for storing a computer program operable for detecting a denial-of-service attack;
- and
- a processor coupled to said memory unit, wherein said processor, responsive to said computer program, comprises:
- circuitry operable for receiving a packet of data to be forwarded to another network;
- circuitry operable for performing a hash function on a source address of said packet of data generating a hash value;
- and
- circuitry operable for determining a number of different hash values generated from performing said hash function on source addresses of a predetermined number of packets to be forwarded to another network, wherein if said number of different hash values is greater than or equal to a predetermined value then said processor further comprises:
- circuitry operable for determining if said predetermined number of packets is at or below a threshold, wherein if said predetermined number of packets is at or below said threshold then said denial-of-service attack is detected.
Dependencies are inferred from the claim text.