# US 8,543,807 B2 · Method and apparatus for protecting application layer in computer network system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,807 B2 - Document ID: US8543807B2 - Status: Granted - Kind: B2 - Application number: 12/643,100 - Filed: 2009-12-21 - Published: 2011-01-20 - Granted: 2013-09-24 - Earliest claimed: 2009-07-14 - Assignees: Electronics and Telecommunications Research Institute - Applicants: Jintae Oh; YouRi Lee; Yang-Seo Choi; Jong Soo Jang - Inventors: Jintae Oh; YouRi Lee; Yang-Seo Choi; Jong Soo Jang - Web page: https://patentgrep.com/patent/US8543807B2 ## CPC - H04L 63/1458: {Denial of Service} - H04L 63/168: {above the transport layer} - H04L 2463/141: Denial of service attacks against endpoints in a network - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and apparatus for protecting an application layer in a computer network system. The method includes creating a session between a client and a data provider in response to a session connection request from the client, and determining the client as an application layer attacking client when the client generates a session termination request before the data provider transmits to the client a response packet to a data request from the client under the created session. ## Claims ### Claim 1 A method for protecting an application layer in a computer network system, comprising: creating a session between a client and a data provider in response to a session connection request from the client; and determining the client as an application layer attacking client when the client generates a session termination request before the data provider transmits to the client a response packet to a data request from the client under the created session, wherein the client is regarded as an attacker when the session termination request is generated between a data service request and a response (ACK) packet transmission. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining the client as the application layer attacking client when the client does not generate an ACK packet to the response packet transmitted from the data provider to the client in response to the data request from the client. ### Claim 3 (depends on 1) The method of claim 1, wherein the application layer attacking client is a client for executing a Distributed Denial of Service (DDoS) attack. ### Claim 4 (depends on 3) The method of claim 3, wherein the DDoS attack includes a Hyper Text Transfer Protocol (HTTP) GET flooding attack and a Cache-Control (CC) flooding attack type. ### Claim 5 (depends on 1) The method of claim 1, further comprising: blocking connection of the client with the data provider when the client generates a session termination request before the data provider transmits to the client a response packet to a data request from the client under the created session. ### Claim 6 (depends on 2) The method of claim 2, further comprising: blocking connection of the client with the data provider when the client does not generate an acknowledgement (ACK) packet to the response packet transmitted from the data provider to the client in response to the data request from the client. ### Claim 7 (depends on 1) The method of claim 1, wherein the data request from the client includes transmitting a GET packet to the data provider. ### Claim 8 (depends on 1) The method of claim 1, wherein the session termination request of the client includes transmitting either a finish (FIN) packet or a reset (RST) packet to the data provider. ### Claim 9 (depends on 1) The method of claim 1, wherein the computer network system is a Transmission Control Protocol/Internet Protocol (TCP/IP) based system. ### Claim 10 (depends on 1) The method of claim 1, wherein the client is determined as an application layer attacking client when a FIN packet is generated within a predetermined time interval from a GET packet. ### Claim 11 An apparatus for protecting an application layer in a computer network system, comprising: a data provider configured to create a session to a client in response to a session connection request from the client and transfer a data packet to the client over the network in response to a data request from the client; and an application layer protection service server designed to detect the client as an application layer attacking client when the client generates a session termination request before the data provider transmits to the client a response packet to the data request from the client under the created session, wherein the client is regarded as an attacker when the session termination request is generated between a data service request and a response (ACK) packet transmission. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the application layer attacking client is a client for executing a Distributed Denial of Service (DDoS) attack. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the DDoS attack includes a Hyper Text Transfer Protocol (HTTP) GET flooding attack and a Cache-Control (CC) flooding attack. ### Claim 14 (depends on 11) The apparatus of claim 11, wherein the application layer protection service server is further configured to determine the client as the application layer attacking client when the client does not generate an ACK packet to the response packet transmitted from the data provider to the client in response to the data request from the client. ### Claim 15 (depends on 11) The apparatus of claim 11, wherein the application layer protection service server is further configured to block connection of the client with the data provider when the client generates a session termination request before the data provider transmits to the client a response packet to a data request from the client under the created session. ### Claim 16 (depends on 14) The apparatus of claim 14, wherein the application layer protection service server is further configured to block connection of the client with the data provider when the client does not generate an acknowledgement (ACK) packet to the response packet transmitted from the data provider to the client in response to the data request from the client. ### Claim 17 (depends on 11) The apparatus of claim 11, wherein the data request of the client is performed by transmitting a GET packet to the server. ### Claim 18 (depends on 11) The apparatus of claim 11, wherein the session termination request of the client is performed by transmitting either a finish (FIN) packet or a reset (RST) packet to the server. ### Claim 19 (depends on 11) The apparatus of claim 11, wherein the system is a Transmission Control Protocol/Internet Protocol (TCP/IP) based system. ### Claim 20 (depends on 11) The apparatus of claim 11, wherein the client is determined as an application layer attacking client when a FIN packet is generated within a predetermined time interval from a GET packet.