Systems and methods for detecting and preventing flooding attacks in a network environment
AssigneeFortinet, Inc.
InventorsShaohong Wei, Gang Duan, Zhongqiang Chen, Bing Xie
Life of this patent
Estimating the term…
Abstract
A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.
Claims13
A method for processing network traffic data, comprising:
- receiving a packet;
- determining whether the packet is a previously dropped packet that is being retransmitted;
- and
- dropping the packet if the packet is not a retransmission of a previously dropped packet.
A method for processing network traffic data, comprising:
- receiving a packet;
- determining whether the packet is a previously dropped packet that is being retransmitted;
- dropping the packet when the packet is not a retransmission of a previously dropped packet;
- and
- wherein the determining comprises comparing the received packet against one or more records in a log, each of the one or more records associating with a previously received packet;
- and
- wherein the determining further comprises:
- identifying a first transmission time of the received packet;
- identifying a second transmission time of a previously received packet;
- calculating a period between the first and second transmission times;
- and
- determining whether the period is within a prescribed threshold.
A method for processing network traffic data, comprising:
- receiving a packet;
- determining whether the packet is a previously dropped packet that is being retransmitted;
- updating a counter based at least in part on the received packet;
- determining whether the counter exceeds a prescribed threshold;
- and
- when the counter exceeds the prescribed threshold and the packet is determined to not to be a retransmitted, previously dropped packet, dropping the packet.
A method for processing network traffic data, comprising:
- receiving a packet;
- determining whether the packet is a previously dropped packet that is being retransmitted;
- when the packet is determined not to be a retransmitted, previously dropped packet, dropping the packet;
- and
- when the packet is determined to be a retransmitted, previously dropped packet, determining whether the packet is associated with a flooding attack.
A system for processing network traffic data, comprising:
- means for receiving a packet;
- means for determining whether the packet is a previously dropped packet that is being retransmitted;
- and
- means for dropping the packet if the packet is not a retransmission of a previously dropped packet.
A computer product includes a non-volatile or volatile computer-readable medium, the computer-readable medium having a set of stored instructions, an execution of which causes a process to be performed, the process comprising:
- receiving a packet;
- determining whether the packet is a previously dropped packet that is being retransmitted;
- and
- dropping the packet if the packet is not a retransmission of a previously dropped packet.
Dependencies are inferred from the claim text.