Systems and methods for detecting and preventing flooding attacks in a network environment

1. A method for processing network traffic data, comprising:

receiving a packet to initiate a new session associated with an Internet Protocol (IP) address;

when the packet is not a previously dropped packet being retransmitted, dropping the packet;

when the packet is a previously dropped packet being retransmitted and when a number N of concurrent sessions for active concurrent sessions associated with the IP address is less than a concurrent session threshold T 1 , passing the packet toward an intended recipient;

when the packet is a previously dropped packet being retransmitted and when the number N of concurrent sessions for active concurrent sessions associated with the IP address is greater than a concurrent session threshold T 1 :

determining a rate R at which the number of sessions N are received within a time period t including a session of the received packet, where R=N÷t;

when the session rate threshold R is less than the prescribed session rate threshold T 2 (R<T 2 ), passing the packet toward the intended recipient; and

classifying the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T 2 (R>T 2 ) and performing a preventative action with regard to the packet.

2. The method of claim 1 , wherein determining whether the packet is not a previously dropped packet being retransmitted comprises:

comparing the received packet against log records, each log record associating with a previously received packet;

when the packet has been previously received:

identifying a transmission time of the received packet;

identifying a transmission time of the previously received packet;

calculating a period between the transmission times of the received and previously received packets; and

determining whether the period is within a prescribed threshold, the received packet determined to be a previously dropped packet when the calculated period is within a retransmission threshold.

3. The method of claim 1 , wherein the concurrent session threshold rate T 1 is adaptive to a time of day to allow for a higher concurrent session threshold rate T 1 during higher demand periods and a lower concurrent session threshold rate T 1 during lower demand periods.

4. The method of claim 3 , further comprising:

maintaining a log of packet processing activity; and

wherein the threshold rate T 1 is determined based at least in part on the log of packet processing activity.

5. The method of claim 4 , wherein determining the concurrent session threshold rate T 1 based at least in part on the log of packet processing activity determines a plurality of concurrent session threshold rates T 1 , each of the plurality concurrent session threshold rates T 1 associated with a source network address from which sessions were initiated, an applicable concurrent threshold rate T 1 identified for a current session based on a source network address from which the packet was received.

6. The method of claim 1 , wherein the prescribed session rate threshold T 2 is selected for comparison based on a type of the received packet.

7. The method of claim 1 , wherein the prescribed session rate threshold T 2 is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.

8. The method of claim 1 , wherein performing a preventative action with regard to the packet includes at least one of forwarding the packet for additional flooding attack consideration processing and forwarding the packet to a content detection module.

9. A non-transitory device-readable storage medium including a set of instructions stored thereon which when executed by a processor of a network switching device cause the network switching device to perform data processing activities comprising:

receiving a packet to initiate a new session associated with an Internet Protocol (IP) address;

when the packet is not a previously dropped packet being retransmitted, dropping the packet;

when the packet is a previously dropped packet being retransmitted and when a number N of concurrent sessions for active concurrent sessions associated with the IP address is less than a concurrent session threshold T 1 , passing the packet toward an intended recipient;

when the packet is a previously dropped packet being retransmitted and when the number N of concurrent sessions for active concurrent sessions associated with the IP address is greater than a concurrent session threshold T 1 :

determining a rate R at which the number of sessions N are received within a time period t including a session of the received packet, where R=N÷t;

when the session rate threshold R is less than the prescribed session rate threshold T 2 (R<T 2 ), passing the packet toward the intended recipient; and

classifying the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T 2 (R>T 2 ) and performing a preventative action with regard to the packet.

10. The non-transitory device-readable storage medium of claim 9 , wherein determining whether the packet is not a previously dropped packet being retransmitted comprises:

comparing the received packet against log records, each log record associating with a previously received packet;

when the packet has been previously received:

identifying a transmission time of the received packet;

identifying a transmission time of the previously received packet;

calculating a period between the transmission times of the received and previously received packets; and

determining whether the period is within a prescribed threshold, the received packet determined to be a previously dropped packet when the calculated period is within a retransmission threshold.

11. The non-transitory device-readable storage medium of claim 9 , wherein the concurrent session threshold rate T 1 is adaptive to a time of day to allow for a higher concurrent session threshold rate T 1 during higher demand periods and a lower concurrent session threshold rate T 1 during lower demand periods.

12. The non-transitory device-readable storage medium of claim 11 , further comprising:

maintaining a log of packet processing activity; and

wherein the threshold rate T 1 is determined based at least in part on the log of packet processing activity.

13. The non-transitory device-readable storage medium of claim 12 , wherein determining the concurrent session threshold rate T 1 based at least in part on the log of packet processing activity determines a plurality of concurrent session threshold rates T 1 , each of the plurality concurrent session threshold rates T 1 associated with a source network address from which sessions were initiated, an applicable concurrent threshold rate T 1 identified for a current session based on a source network address from which the packet was received.

14. The non-transitory device-readable storage medium of claim 9 , wherein the prescribed session rate threshold T 2 is selected for comparison based on a type of the received packet.

15. The non-transitory device-readable storage medium of claim 9 , wherein the prescribed session rate threshold T 2 is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.

16. The non-transitory device-readable storage medium of claim 9 , wherein performing a preventative action with regard to the packet includes at least one of forwarding the packet for additional flooding attack consideration processing and forwarding the packet to a content detection module.

17. A network switching device, comprising:

a processor;

a communication interface for communicating over a network:

a memory device including instructions stored thereon which when executed by the processor, cause the device to perform data processing activities comprising:

receiving a packet to initiate a new session associated with an Internet Protocol (IP) address;

when the packet is not a previously dropped packet being retransmitted, dropping the packet;

when the packet is a previously dropped packet being retransmitted and when a number N of concurrent sessions for active concurrent sessions associated with the IP address is less than a concurrent session threshold T 1 , passing the packet toward an intended recipient;

when the packet is a previously dropped packet being retransmitted and when the number N of concurrent sessions for active concurrent sessions associated with the IP address is greater than a concurrent session threshold T 1 :

determining a rate R at which the number of sessions N are received within a time period t including a session of the received packet, where R=N÷t;

when the session rate threshold R is less than the prescribed session rate threshold T 2 (R<T 2 ), passing the packet toward the intended recipient; and

classifying the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T 2 (R>T 2 ) and performing a preventative action with regard to the packet.

18. The network switching device of claim 17 , wherein determining whether the packet is not a previously dropped packet being retransmitted comprises:

comparing the received packet against log records, each log record associating with a previously received packet;

when the packet has been previously received:

identifying a transmission time of the received packet;

identifying a transmission time of the previously received packet;

calculating a period between the transmission times of the received and previously received packets; and

determining whether the period is within a prescribed threshold, the received packet determined to be a previously dropped packet when the calculated period is within a retransmission threshold.

19. The network switching device of claim 17 , further comprising:

maintaining a log of packet processing activity; and

wherein:

the concurrent session threshold rate T 1 is adaptive to a time of day to allow for a higher concurrent session threshold rate T 1 during higher demand periods and a lower concurrent session threshold rate T 1 during lower demand periods;

the threshold rate T 1 is determined based at least in part on the log of packet processing activity.

20. The network switching device of claim 17 , wherein:

the prescribed session rate threshold T 2 is selected for comparison based on a type of the received packet;

the prescribed session rate threshold T 2 is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day; and

performing a preventative action with regard to the packet includes at least one of forwarding the packet for additional flooding attack consideration processing and forwarding the packet to a content detection module.