Methods and systems to detect an evasion attack

A system comprising:

• a repository to store a plurality of signature fragments that together constitute an attack signature;
• an interceptor to intercept a data packet associated with a network connection;
• a string-matching module to determine that the data packet comprises a signature fragment from the plurality of fragments thereby identifying a match;
• a responder to perform a prevention action in response to the match;
• a detector to detect that a size of the data packet is less than a size threshold, wherein the size threshold is dependent on a size of a signature fragment from the plurality of signature fragments;
• and
• a state machine to commence maintaining a state for the network connection in response to the detector determining that the size of the data packet is less than the size threshold.

A method comprising:

• intercepting a data packet associated with a network connection;
• performing a prevention action if the data packet comprises a signature fragment from a plurality of signature fragments, the plurality of signature fragments identifying an attack;
• and
• commencing to maintain a state for the network connection if a size of the data packet is less than a size threshold, the size threshold being dependent on a size of a signature fragment from the plurality of signature fragments.

A machine-readable medium having stored thereon data representing sets of instructions which, when executed by a machine, cause the machine to:

• store a plurality of signature fragments that together constitute an attack signature;
• intercept a data packet associated with a network connection;
• determine that the data packet comprises a signature fragment from the plurality of fragments thereby identifying a match;
• perform a prevention action in response to the match;
• detect that a size of the data packet is less than a size threshold, wherein the size threshold is dependent on a size of a signature fragment from the plurality of signature fragments;
• and
• commence maintaining a state for the network connection in response to the detector determining that the size of the data packet is less than the size threshold.

A system comprising:

• means for intercepting a data packet associated with a network connection;
• means for performing a prevention action if the data packet comprises a signature fragment from a plurality of signature fragments, the plurality of signature fragments identifying an attack;
• and
• means for commencing to maintain a state for the network connection if a size of the data packet is less than a size threshold, the size threshold being dependent on a size of a signature fragment from the plurality of signature fragments.