US 8,819,821 B2 · Proactive test-based differentiation method and system to mitigate low rate DoS attacks

Abstract

A low rate DoS attack detection algorithm is used, which relies on a characteristic of the low rate DoS attack in introducing high rate traffic for short periods, and then uses a proactive test based differentiation technique to filter the attack packets. The proactive test defends against DDoS attacks and low rate DoS attacks which tend to ignore the normal operation of network protocols, but it also differentiates legitimate traffic from low rate DoS attack traffic instigated by botnets. It leverages on the conformity of legitimate flows, which obey the network protocols. It also differentiates legitimate connections by checking their responses to the proactive tests which include puzzles for distinguishing botnets from human users.

Claims17

Dependent claims

A system comprising:

memory;
a processor, communicatively coupled to the memory and configured to:
receive communication flow information from incoming packets to a router on a network;
detect a low rate denial of service (DoS) attack if a total number of bytes of expired flows in a communication flow received at the router exceeds a detection threshold, wherein the detection threshold is greater than or equal to C+B, where C is a link capacity and B is a router buffer size;
and
in response to detection of the attack, activate a proactive test-based differentiation technique (PTDT) module,
wherein the PTDT module is configured to admit a communication flow into the network based on a pass counter, wherein the pass counter indicates a number of times the communication flow is found to reduce a communicate rate in response to the PTDT module dropping a packet in the communication flow.

4 more elements

Dependencies are inferred from the claim text.

Proactive test-based differentiation method and system to mitigate low rate DoS attacks

Life of this patent

Proactive test-based differentiation method and system to mitigate low rate DoS attacks

Life of this patent

Abstract

Claims17