Systems and methods for detecting and preventing flooding attacks in a network environment
AssigneeFortinet, Inc.
InventorsShaohong Wei, Gang Duan, Zhongqiang Chen, Bing Xie
Life of this patent
Estimating the term…
Abstract
A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.
Claims18
A method for processing network traffic content, comprising:
- receiving a plurality of headers, the plurality of headers having respective first field values;
- and
- determining whether the first field values of the respective headers form a first prescribed pattern, the determining being at least a part of classifying network traffic content as part of a flooding attack;
- wherein the determining comprises determining whether the first field values of the respective headers are identical by comparing a hash value calculated based at least in part on the first field value with a log of hash values calculated from at least first field values of previously received packets, the log stored on a data storage device, the log of hash values allowing for the comparing without requiring saving of previously received packets.
A computer product includes a non-transitory non-volatile or volatile computer-readable medium, the computer-readable medium having a set of stored instructions, executable by a processor to cause performance of the following:
- receiving a plurality of headers, the plurality of headers having respective first field values;
- and
- determining whether the first field values of the respective headers form a first prescribed pattern, the determining being at least a part of classifying network traffic content as part of a flooding attack;
- wherein the determining comprises determining whether the first field values of the respective headers are identical by comparing a hash value calculated based at least in part on the first field value with a log of hash values calculated from at least first field values of previously received packets, the log stored on a data storage device, the log of hash values allowing for the comparing without requiring saving of previously received packets.
Dependencies are inferred from the claim text.