US 8,180,917 B1 · Packet threshold-mix batching dispatcher to counter traffic analysis

Abstract

An antivirus agent located on a user computer, local area network or standalone hardware device includes a statistical module, a control unit, a timeslot generator and a dispatcher. The statistical module calculates statistics for incoming request packets including the burstiness degree H. A number of normal distributions are predefined. A number of probability sequences are predefined. An input statistic is used to select one of the probability sequences. This probability sequence is used to select a timer value from the distributions. Packets are loaded into a variable-length buffer in the dispatcher to form the timer expires or when the buffer is full. The rate of the output traffic from the dispatcher depends upon a selected distribution value by the timeslot generator and not by any manufactured timing by an attacker. Output traffic frequency is shaped by the dispatcher; packets may go out faster or slower, thus thwarting an attacker who relies upon their own inserted packet timing.

Claims29

Dependent claims

A method of dispatching communication packets over a network from a software agent to an Internet server, said method comprising:

defining a plurality of distributions;
defining a plurality of probability sequences, each of said probability sequences including a known numerical probability for use with each of said distributions;
receiving an input stream of communication packets in said software agent, said communication packets originating from at least one user computer and destined for said Internet server;
storing a portion of said communication packets in a variable length buffer of a dispatcher of said software agent, said dispatcher including a timer but not including a fixed length buffer;
calculating a statistic based upon said input stream of communication packets;
choosing one of said probability sequences based upon said statistic after said probability sequences have been defined;
choosing a value for said timer based upon said chosen probability sequence;
placing said value into said timer of said dispatcher;
and
sending said communication packets over said network when said timer expires or when said variable length buffer is full.

7 more elements

Dependencies are inferred from the claim text.

Packet threshold-mix batching dispatcher to counter traffic analysis

Life of this patent

Packet threshold-mix batching dispatcher to counter traffic analysis

Life of this patent

Abstract

Claims29