System method and apparatus for service attack detection on a network

A network detection system, comprising:

• a router that receives information packets from a first network device and is configured to direct the information packets to a protected network device;
• an activity monitoring system coupled to the router and configured to receive the information packets from the router, the activity monitoring system comprising a detector module and an analyzer module,
• the detector module configured to monitor the information packets received from the router destined for the protected network device and determine whether the information packets are abnormal in accordance with a first predetermined criteria;
• and
• the analyzer module configured to receive information packets detected by the detector module as being abnormal based on the first predetermined criteria, and analyze the information packets detected as being abnormal to determine whether the information packets detected as being abnormal satisfy a second predetermined criteria,
• the activity monitoring system further configured to inhibit the information packets that are determined to satisfy the second predetermined criteria from reaching the protected network device.

A denial of service attack detection system, comprising:

• at least one network switching device that receives traffic, comprising information packets, from a network and is coupled to at least one network device, the at least one network switching device configured to receive traffic from a transmitting network device and to direct that traffic to a targeted network device coupled to the at least one switching device;
• a firewall coupled to the switching device and the targeted network device such that traffic directed to the targeted network device passes through the firewall, the firewall configured to protect the targeted network device from undesired transmissions and configured to block the undesired transmissions from reaching the targeted network device;
• at least one detector coupled to the at least one network switching device and configured to receive traffic from the at least one network switching device, the detector configured to detect unusual traffic patterns in traffic directed to the targeted network device that match a first set of parameters;
• and
• at least one analyzer coupled to the at least one detector to receive traffic that matches the first set of parameters, and configured to compare the traffic received from the at least one detector with a second set of parameters to determine whether the traffic received from the at least one detector may constitute a denial of service attack, and
• the at least one analyzer configured to cause the traffic determined to match the second set of parameters to be redirected such that the traffic determined to match the second set of parameters does not reach the targeted network device.

A method for detecting abnormal traffic flow in a network, comprising:

• monitoring traffic passing from a switching device to a network device;
• detecting abnormal traffic patterns by comparing the traffic passing from the switching device to the network device with a first set of criteria;
• comparing any detected abnormal traffic patterns with a second set of criteria,
• inhibiting the abnormal traffic determined to match the second set of criteria from being transmitted to the network device, and
• allowing legitimate traffic to pass to the network device.