Statistical methods for detecting TCP SYN flood attacks
View Patent ↗Methods of detecting TCP SYN flooding attacks at a router located between a LAN and a network such as the Internet are described. The methods rely on a counting arrangement in which SYN and Fin packets are counted on both the LAN side and the network or Internet side of the router during a time interval. Weighting factors are applied to each count, the factor for the LAN side count having the opposite polarity to the factor for the network side count. The absolute values of the sums of the weighting factors of like polarity are equal. An abnormal number of unsuccessful connection attempts are determined based on a parameter calculated using the weighting factors in conjunction with the respective counts.
1. A method of detecting an abnormal number of unsuccessful connection attempts in a router located between a LAN and a network in a communications system, the method comprising the steps:
a) maintaining a count of SYN packets, a count of SYN/ACK packets, and a count of FIN packets, for packets arriving on the LAN side of the router during a predetermined time interval;
b) maintaining a count of SYN packets, a count of SYN/ACK packets, and a count of FIN packets, for packets arriving on the network side of the router during the predetermined time interval;
c) multiplying each count by a respective weighting factor, wherein:
i) the weighting factor associated with each count in step a) is positive;
ii) the sum of the weighting factors of any partial connection coming from the attacking side is positive; and
iii) the sum of the weighting fuctors associated with the counts of SYN and FIN packets in one direction plus the sum of the weighting factors associated with the counts of SYN/ACK and FIN in the other direction is zero;
d) calculating a parameter that equals the sum of the products of step c), the parameter for detecting attacks; and
e) determining that an abnormal number of unsuccessful connection attempts has occurred responsive to the behavior defined in step d) over successive time intervals.
2. The method as defined in claim 1 wherein each of the weighting factors takes on a unique value, the conditions of step c) being maintained.
3. The method as defined in claim 2 wherein the predetermined time intervals are one of continuous or non-overlapping sliding windows.
4. The method as defined in claim 1 wherein step e) further comprises using any one of cumulative sum, moving average or filtered derivative to detect changes in the parameter.
5. The method as defined in claim 1 wherein the equation for detecting the LAN side originating attacks has the form:
F=x#SYN LAN +x#SYN/ACK LAN +#FIN LAN −#SYN NET −#SYN/ACK NET −x#FIN NET ;
where F is the parameter detecting attacks from the LAN;
X is the weighting factor;
#SYN LAN is the number of SYN packets arriving at the LAN side;
#SYN/ACK LAN is the number of SYN/ACK packets arriving on the LAN side
#FIN LAN is the number of FIN packets arriving at the LAN side;
#SYN NET is the number of SYN packets arriving at the network side; and
#SYN/ ACK is the number of SYN/ACK packets arriving at the network side; and
#FIN NET is the number of FIN packets arriving at the network side.
6. The method as defined in claim 1 wherein the equation for detecting the network side originating attacks has the form:
L=x#SYN NET +x#SYN/ACK NET +#FIN NET −#SYN LAN −#SYN/ACK LAN −x#FIN LAN ;
where L is the parameter detecting attacks from the network side; and
x is the weighting factor.
7. The method as defined in claim 1 wherein the equation for detecting a LAN side originating attack has the form:
F=#SYN LAN +#SYN NET
where F is the paramueter for detecting attacks from the LAN.
8. The method as defined in claim 1 wherein the equation for detecting the network side originating attack has the form:
L=#SYN NET +#SYN LAN −#FIN LAN
where L is the parameter for detecting attacks from the network side.
9. A method of detecting an abnormal number of unsuccessful connection attempts in a router located between a LAN and a network in a communications system, the method comprising the steps:
a) maintaining a count of SYN packets, a count of SYN/ACK packets, a count of FIN packets, and a count of RST packets for packets arriving on the LAN side of the router during a predetermined time interval;
b) maintaining a count of SYN packets, a count of SYN/ACK packets, a count of FIN packets, and a count of RST packets, for packets arriving on the network side of the router during the predetermined time interval;
c) multiplying each count by a respective weighting factor, wherein:
i) the weighting factor associated with each count in step a) is positive;
ii) the sum of the weighting factors of any partial connection coming from the attacking side is positive; and
iii) the sum of the weighting factors associated with the counts of SYN and FIN and RST packets in one direction plus the sum of the weighting factors associated with the counts of SYN/ACK and FIN and RST packets in the other direction is zero;
d) calculating a parameter that equals the sum of the products of step c), the parameter for detecting attacks; and
e) determining that an abnormal number of unsuccessful connection attempts has occurred responsive to the behavior defined in step d) over successive time intervals.
10. The method as defined in claim 9 wherein each of the weighting factors takes on a unique value, the conditions of step c) being maintained.
11. The method as defined in claim 10 wherein the predetermined time intervals are one of continuous or non-overlapping sliding windows.
12. The method as defined in claim 9 wherein step e) further comprises using any one of cumulative sum, moving average or filtered derivative to detect changes in the parameter.
13. The method as defined in claim 9 wherein the equation for detecting the LAN side originating attacks has the form:
F=x#SYN LAN x#SYN/ACK LAN +#RST LAN +#FIN LAN −#SYN NET −#SYN/ACK NET −x#RST NET −x#FIN NET ;
where F is the parameter for detecting attacks from the LAN;
X is the weighting factor;
#SYN LAN is the number of SYN packets arriving at the LAN side;
#SYN/ACK LAN is the number of SYN/ACK packets arriving on the LAN side
#RST LAN is the number of Reset packets arriving at the LAN side;
#FIN LAN is the number of FIN packets arriving at the LAN side;
#SYN NET is the number of SYN packets arriving at the network side; and
#SYN/ACK NET is the number of SYN/ACK packets arriving at the network side;
#RST NET is the number of FIN packets arriving at the network side; and
#FlN NET is the number of FIN packets aniving at the network side.
14. The method as defined in claim 9 wherein the equation for detecting the network side originating attacks has the form:
L=x#SYN NET x#SYN/ACK NET +#RST NET +#FIN NET −#SYN LAN −#SYN/ACK LAN −x#RST LAN −x#FIN LAN ;
where L is the parameter for detecting attacks from the network side; and
x is the weighting factor.
15. The method as defined in claim 9 wherein the equation for detecting a LAN side originating attack has tine form:
F=#SYN NET +#SYN NET −#RST NET −#FIN LAN
where F is the parameter for detecting attacks from the LAN.
16. The method as defined in claim 9 wherein the equation for detecting the network side originating attack has the form:
L=#SYN NET +#SYN LAN −#RST LAN −#FlN LAN
where L is the parameter for detecting attacks from the network side.