Back to results
US 8,020,205 B2Granted
Unauthorized information detection system and unauthorized attack source search system
AssigneeCyber Solutions Inc.
InventorGlenn Mansfield Keeni
Life of this patent
Estimating the term…
Abstract
A system for detecting and tracing a (D)DoS attack and identifying the attack source, which system simplifies the judgment reference to determine whether a (D)DoS attack is present. The number of source addresses of the packets transmitted via the Internet line is monitored. When the number of the source addresses has reached a predetermined number or a predetermined ratio within a predetermined time, it is judged that an unauthorized attack is present. Moreover, where the hop number of the packet is different from a hop number corresponding to the transmission source information, the packet is judged to be malicious.
Claims11
A network attack detection system, comprising a hardware communications monitor programmed to perform the steps of:
- examining a header of a packet in transmission;
- observing values of one or more pre-specified fields in the packet header;
- and
- in a case where a number of distinct values observed in the pre-specified fields reaches a pre-specified threshold suggesting a pre-specified ratio within a pre-specified time interval, judging that an unauthorized attack is in progress;
- wherein the judging is carried out based on one of the following conditions where N(t) is the number of distinct values of the field observed within a pre-specified time interval from time t, N(t1) is the number of distinct values of the field observed within the pre-specified time interval from some time t1, P(t) is a number of packets in transmission within the pre-specified time interval from time t, P(t1) is the number of packets in transmission within the pre-specified time interval from some time t1, and T(t) is the number of octets or bits in the packets in transmission within the pre-specified time interval from some time t:
- (a) if the ratio of N(t) to N(t1) is greater than or equal to a first pre-specified threshold k1, that is, if N(t)/N(t1)≧k1, the system will judge that an attack is in progress;
- (b) if the ratio of N(t) to P(t) is greater than or equal to a second pre-specified threshold k2, that is, N(t)/P(t)≧k2, the system will judge that an attack is in progress;
- (c) if the ratio of {N(t)/P(t)} to {N(t1)/P(t1)}, is greater than or equal to a third pre-specified threshold k3, that is, {N(t)/P(t)}/{N(t1)/P(t1)}≧k3, the system will judge that an attack is under progress;
- or
- (d) if the ratio N(t) to T(t) is greater than or equal to a fourth pre-specified threshold k4, that is, N(t)/T(t)≧k4, the system will judge that an attack is in progress.
7 more elements
A network attack tracking system, comprising:
- two or more network attack detection systems,
- wherein a source of the unauthorized attack is searched by deploying said two or more network attack detection systems at various places on the Internet, and
- wherein each network attack detection system comprises a hardware communications monitor programmed to perform the steps of:
- examining a header of a packet in transmission;
- observing values of one or more pre-specified fields in the packet header;
- and
- in a case where a number of distinct values observed in the pre-specified fields reaches a pre-specified threshold suggesting a pre-specified ratio within a pre-specified time interval, judging that an unauthorized attack is in progress;
- wherein the judging is carried out based on one of the following conditions where N(t) is the number of distinct values of the field observed within a pre-specified time interval from time t, N(t1) is the number of distinct values of the field observed within the pre-specified time interval from some time t1, P(t) is a number of packets in transmission within the pre-specified time interval from time t, P(t1) is the number of packets in transmission within the pre-specified time interval from some time t1, and T(t) is the number of octets or bits in the packets in transmission within the pre-specified time interval from some time t:
- (a) if the ratio of N(t) to N(t1) is greater than or equal to a first pre-specified threshold k1, that is, if N(t)/N(t1)≧k1, the system will judge that an attack is in progress;
- (b) if the ratio of N(t) to P(t) is greater than or equal to a second pre-specified threshold k2, that is, N(t)/P(t)≧k2, the system will judge that an attack is in progress;
- (c) if the ratio of {N(t)/P(t)} to {N(t1)/P(t1)}, is greater than or equal to a third pre-specified threshold k3, that is, {N(t)/P(t)}/{N(t1)/P(t1)}≧k3, the system will judge that an attack is under progress;
- or
- (d) if the ratio N(t) to T(t) is greater than or equal to a fourth pre-specified threshold k4, that is, N(t)/T(t)≧k4, the system will judge that an attack is in progress.
10 more elements
A method for detecting a network attack, comprising the steps of:
- examining a header of a packet in transmission;
- observing values of one or more pre-specified fields in the packet header;
- and
- in a case where a number of distinct values observed in the pre-specified field reaches a pre-specified threshold suggesting a pre-specified ratio within a pre-specified time interval, judging that an unauthorized attack is in progress;
- wherein the judging is carried out based on one of the following conditions where N(t) is the number of distinct values of the field observed within a pre-specified time interval from time t, N(t1) is the number of distinct values of the field observed within the pre-specified time interval from some time t1, P(t) is a number of packets in transmission within the pre-specified time interval from time t, P(t1) is the number of packets in transmission within the pre-specified time interval from some time t1, and T(t) is the number of octets or bits in the packets in transmission within the pre-specified time interval from some time t:
- (a) if the ratio of N(t) to N(t1) is greater than or equal to a first pre-specified threshold k1, that is, if N(t)/N(t1)≧k1, the system will judge that an attack is in progress;
- (b) if the ratio of N(t) to P(t) is greater than or equal to a second pre-specified threshold k2, that is, N(t)/P(t)≧k2, the system will judge that an attack is in progress;
- (c) if the ratio of {N(t)/P(t)} to {N(t1)/P(t1)}, is greater than or equal to a third pre-specified threshold k3, that is, {N(t)/P(t)}/{N(t1)/P(t1)}≧k3, the system will judge that an attack is under progress;
- or
- (d) if the ratio N(t) to T(t) is greater than or equal to a fourth pre-specified threshold k4, that is, N(t)/T(t)≧k4, the system will judge that an attack is in progress.
7 more elements
Dependencies are inferred from the claim text.