Detecting network denial of service attacks
AssigneeCisco Technology, Inc.
InventorsPritam Shah, Chengelpet Ramesh, Vamsidhar Valluri
Life of this patent
Estimating the term…
Abstract
A method for detecting a suspicious packet flow in a packet-switched network comprises the computer-implemented step of receiving a first packet in which the SYN bit but not the ACK or RST bit of the packet's TCP header is set. If a specified first time has elapsed, a packet counter associated with the destination address of the flow is incremented. A determination as to whether the packet counter is greater than a specified threshold values is made. If the packet counter is greater than the threshold value, a notification message is generated. In one embodiment, information identifying a packet flow is aggregated to an aggregation cache based on the destination address of the flow.
Claims45
A method of detecting a suspicious packet flow in a packet-switched network, comprising the computer-implemented steps of:
- receiving a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- incrementing a packet counter associated with a destination address of the flow if a specified first time has elapsed;
- determining if the packet counter associated with the destination address is greater than a specified threshold value;
- and
- generating a notification message when the packet counter has exceeded the threshold value.
A method of detecting a suspicious packet flow in a packet-switched network, comprising the computer-implemented steps of:
- receiving a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- receiving a second packet of the flow in which a RST bit of the TCP header is set;
- determining a time difference between when the first packet was received and when the second packet was received;
- incrementing a flow counter associated with the destination address of the flow if the time difference is less than a specified global connection uptime value;
- determining if the flow counter associated with the destination address is greater than a specified threshold value;
- and
- generating a notification message when the flow counter has exceeded the threshold value.
A method of detecting a suspicious packet flow in a packet-switched network, comprising the computer-implemented steps of:
- receiving, at a router, a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- incrementing a packet counter stored at the router and associated with a destination address of the flow if a specified first time has elapsed;
- determining if the packet counter associated with the destination address is greater than a specified threshold value;
- and
- generating a notification message when the packet counter has exceeded the threshold value.
A method of detecting a suspicious packet flow in a packet-switched network, comprising the computer-implemented steps of:
- receiving, at a router, a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- receiving, at the router, a second packet of the flow in which a RST bit of the TCP header is set;
- determining a time difference between when the first packet was received and when the second packet was received;
- incrementing a flow counter stored at the router and associated with the destination address of the flow if the time difference is less than a specified global connection uptime value;
- determining if the flow counter associated with the destination address is greater than a specified threshold value;
- and
- generating a notification message when the flow counter has exceeded the threshold value.
An apparatus for detecting a suspicious packet flow in a packet-switched network, comprising:
- means for receiving a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- means for incrementing a packet counter associated with a destination address of the flow if a specified first time has elapsed;
- means for determining if the packet counter associated with the destination address is greater than a specified threshold value;
- and
- means for generating a notification message when the packet counter has exceeded the threshold value.
An apparatus for detecting a suspicious packet flow in a packet-switched network, comprising:
- means for receiving a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- means for receiving a second packet of the flow in which a RST bit of the TCP header is set;
- means for determining a time difference between when the first packet was received and when the second packet was received;
- means for incrementing a flow counter associated with the destination address of the flow if the time difference is less than a specified global connection uptime value;
- means for determining if the flow counter associated with the destination address is greater than a specified threshold value;
- and
- means for generating a notification message when the flow counter has exceeded the threshold value.
An apparatus for detecting a suspicious packet flow in a packet-switched network, comprising:
- a processor;
- one or more stored sequences of instructions that are accessible to the processor and which, when executed by the processor, cause the processor to carry out the steps of:
- receiving a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- incrementing a packet counter associated with a destination address of the flow if a specified first time has elapsed;
- determining if the packet counter associated with the destination address is greater than a specified threshold value;
- and
- generating a notification message when the packet counter has exceeded the threshold value.
An apparatus of detecting a suspicious packet flow in a packet-switched network, comprising:
- a processor;
- one or more stored sequences of instructions that are accessible to the processor and which, when executed by the processor, cause the processor to carry out the steps of:
- receiving a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- receiving a second packet of the flow in which a RST bit of the TCP header is set;
- determining a time difference between when the first packet was received and when the second packet was received;
- incrementing a flow counter associated with the destination address of the flow if the time difference is less than a specified global connection uptime value;
- determining if the flow counter associated with the destination address is greater than a specified threshold value;
- and
- generating a notification message when the flow counter has exceeded the threshold value.
A computer-readable medium carrying one or more sequences of instructions for detecting a suspicious packet flow in a packet-switched network, wherein the execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:
- receiving a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- incrementing a packet counter associated with a destination address of the flow if a specified first time has elapsed;
- determining if the packet counter associated with the destination address is greater than a specified threshold value;
- and
- generating a notification message when the packet counter has exceeded the threshold value.
A computer-readable medium carrying one or more sequences of instructions for detecting a suspicious packet flow in a packet-switched network, wherein the execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:
- receiving a first packet of a flow in which a SYN bit but not an ACK or RST bit of a TCP header is set;
- receiving a second packet of the flow in which a RST bit of the TCP header is set;
- determining a time difference between when the first packet was received and when the second packet was received;
- incrementing a flow counter associated with the destination address of the flow if the time difference is less than a specified global connection uptime value;
- determining if the flow counter associated with the destination address is greater than a specified threshold value;
- and
- generating a notification message when the flow counter has exceeded the threshold value.
Dependencies are inferred from the claim text.