# US 2017/0366575 A1 · Management of cellular data usage during denial of service (dos) attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0366575 A1 - Document ID: US20170366575A1 - Status: Published application - Kind: A1 - Application number: 15/184,749 - Filed: 2016-06-16 - Published: 2017-12-21 - Earliest claimed: 2016-06-16 - Assignees: Fortinet, Inc. - Applicants: Fortinet, Inc. - Inventors: Shashidhar Reddy Polepalli; Pankajkumar Chechani - Web page: https://patentgrep.com/patent/US20170366575A1 ## CPC - H04L 63/1458: {Denial of Service} - H04L 47/2458: {Modification of priorities while in transit} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04W 28/0263: {involving mapping traffic to individual bearers or channels, e.g. traffic flow template [TFT]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods for managing data usage of a cellular modem during DoS/DDoS attacks are provided. According to one embodiment, a network security device of a private network detects a DoS attack in network traffic going through the network security device and determines whether the DoS attack is being transmitted through a cellular modem of a cellular data network. The network security device reduces data usage of the cellular modem when the DoS attack is detected and the DoS attack being is transmitted through the cellular modem. ## Claims ### Claim 1 A method comprising: detecting, by a network security device of a private network, a denial of service (DoS) attack in network traffic observed by the network security device; determining, by the network security device, whether the DoS attack is being transmitted through a cellular modem associated with a cellular data network; and reducing, by the network security device, data usage of the cellular modem when a result of said determining is affirmative. ### Claim 2 (depends on 1) The method of claim 1, wherein said reducing, by the network security device, data usage of the cellular modem further comprises sending, by the network security device, a control command to the cellular modem to reduce its usage of the cellular data network. ### Claim 3 (depends on 2) The method of claim 2, wherein said sending, by the network security device, a control command to a cellular modem to reduce its usage of the cellular data network further comprises setting, by the network security device, a traffic flow template (TFT) on the cellular modem, wherein the TFT is used for routing of downlink packets onto different quality of service (QoS) flows towards the cellular modem. ### Claim 4 (depends on 1) The method of claim 1, wherein said reducing, by the network security device, data usage of the cellular modem further comprises sending, by the network security device, a control command to a command server of the cellular data network to reduce the data usage of the cellular data network. ### Claim 5 (depends on 4) The method of claim 4, wherein said sending, by the network security device, a control command to a cellular data network carrier to reduce the data usage of the cellular data network further comprises: encoding, by the network security device, information regarding the DoS attack within the control command; sending, by the network security device, the information regarding the DoS attack to the command server of the cellular data network, wherein the information regarding the DoS attack is decoded by the command server and network traffic deemed to be associated with the DoS attack based on the information regarding the DoS attack is blocked or at least reduced by the cellular data network. ### Claim 6 (depends on 4) The method of claim 4, further comprising authenticating, by the network security device, with the command server of the cellular data network before sending the control command. ### Claim 7 (depends on 4) The method of claim 4, wherein the control command is sent by the cellular modem through a short message service (SMS) message to the command server of the cellular data network. ### Claim 8 (depends on 7) The method of claim 7, further comprising: detecting, by the network security device, whether the private network has lost its network connection with the cellular data network; and when a result of said detecting is affirmative, then sending the control command through the SMS message. ### Claim 9 (depends on 1) The method of claim 1, further comprising restoring, by the network security device, the data usage of the cellular modem when the DoS attack is determined to be over. ### Claim 10 A network security device comprising: a non-transitory storage device having embodied therein instructions representing a security application; and one or more processors coupled to the non-transitory storage device and operable to execute the security application to perform a method comprising: detecting a denial of service (DoS) attack in network traffic of a private network protected by the network security device; determining whether the DoS attack is being transmitted through a cellular modem associated with a cellular data network used by the private network; and reducing data usage of the cellular modem when a result of said determining is affirmative. ### Claim 11 (depends on 10) The network security device of claim 10, wherein said reducing data usage of the cellular modem further comprises sending a control command to the cellular modem to reduce its usage of the cellular data network. ### Claim 12 (depends on 11) The network security device of claim 11, wherein said sending a control command to a cellular modem to reduce its usage of the cellular data network further comprises setting a traffic flow template (TFT) on the cellular modem, wherein the TFT is used for routing of downlink packets onto different quality of service (QoS) flows towards the cellular modem. ### Claim 13 (depends on 10) The network security device of claim 10, wherein said reducing data usage of the cellular modem further comprises sending a control command to a command server of the cellular data network to reduce the data usage of the cellular data network. ### Claim 14 (depends on 13) The network security device of claim 13, wherein said sending a control command to a cellular data network carrier to reduce the data usage of the cellular data network further comprises: encoding information regarding the DoS attack within the control command; sending the information regarding the DoS attack to the command server of the cellular data network, wherein the information regarding the DoS attack is decoded by the command server and network traffic deemed to be associated with the DoS attack based on the information regarding the DoS attack is blocked or at least reduced by the cellular data network. ### Claim 15 (depends on 13) The network security device of claim 13, wherein the method further comprises authenticating with the command server of the cellular data network before sending the control command. ### Claim 16 (depends on 13) The network security device of claim 13, wherein the control command is sent by the cellular modem through a short message service (SMS) message to the command server of the cellular data network. ### Claim 17 (depends on 16) The network security device of claim 16, wherein the method further comprises: detecting whether the private network has lost its network connection with the cellular data network; and when a result of said detecting is affirmative, then sending the control command through the SMS message. ### Claim 18 (depends on 10) The network security device of claim 10, wherein the method further comprises restoring the data usage of the cellular modem when the DoS attack is determined to be over.