Systems and methods for detecting and preventing flooding attacks in a network environment

1. A method for processing network traffic content, comprising:

receiving a plurality of headers, the plurality of headers having respective first field values; and

determining whether the first field values of the respective headers form a first prescribed pattern, the determining being at least a part of classifying network traffic content as part of a flooding attack;

wherein the determining comprises determining whether the first field values of the respective headers are identical by comparing a hash value calculated based at least in part on the first field value with a log of hash values calculated from at least first field values of previously received packets, the log stored on a data storage device, the log of hash values allowing for the comparing without requiring saving of previously received packets.

2. The method of claim 1 , wherein the determining comprises:

calculating checksum values for the respective first field values; and

determining whether the checksum values form the first prescribed pattern.

3. The method of claim 1 , wherein the plurality of headers are received within a prescribed period.

4. The method of claim 1 , wherein each of the headers is selected from the group consisting of a TCP header, an IP header, an UDP header, and an ICMP header.

5. The method of claim 1 , wherein each of the first field values is selected from the group consisting of a sequence number, a network order, an identification field value, a TCP flag, a TCP option, and an IP option.

6. The method of claim 1 , further comprising determining whether second field values of the respective headers form a second prescribed pattern.

7. The method of claim 1 , further comprising performing a task based at least in part on the determining, the task selected from the group consisting of dropping a packet, terminating a session, and sending a message to a user.

8. The method of claim 1 , further comprising:

receiving an additional header; and

determining whether a portion of the additional header falls within the first prescribed pattern.

9. The method of claim 1 , further comprising:

receiving an additional header after the plurality of headers are received; and

determining whether a portion of the additional header is related to a portion of a header associated with a flooding attack.

10. A computer product includes a non-transitory non-volatile or volatile computer-readable medium, the computer-readable medium having a set of stored instructions, executable by a processor to cause performance of the following:

receiving a plurality of headers, the plurality of headers having respective first field values; and

determining whether the first field values of the respective headers form a first prescribed pattern, the determining being at least a part of classifying network traffic content as part of a flooding attack;

wherein the determining comprises determining whether the first field values of the respective headers are identical by comparing a hash value calculated based at least in part on the first field value with a log of hash values calculated from at least first field values of previously received packets, the log stored on a data storage device, the log of hash values allowing for the comparing without requiring saving of previously received packets.

11. The computer product of claim 10 , wherein the determining comprises:

calculating checksum values for the respective first field values; and

determining whether the checksum values form the first prescribed pattern.

12. The computer product of claim 10 , wherein the plurality of headers are received within a prescribed period.

13. The computer product of claim 10 , wherein each of the headers is selected from the group consisting of a TCP header, an IP header, an UDP header, and an ICMP header.

14. The computer product of claim 10 , wherein each of the first field values is selected from the group consisting of a sequence number, a network order, an identification field value, a TCP flag, a TCP option, and an IP option.

15. The computer product of claim 10 , wherein the computer-readable medium has further stored instructions, execution of which by the processor further causes performance of a determining whether second field values of the respective headers form a second prescribed pattern.

16. The computer product of claim 10 , wherein the computer-readable medium has further stored instructions, execution of which by the processor further causes performance of a performance of a task based at least in part on the determining, the task selected from the group consisting of dropping a packet, terminating a session, and sending a message to a user.

17. The computer product of claim 10 , wherein the computer-readable medium has further stored instructions, execution of which by the processor further causes performance of:

receiving an additional header; and

determining whether a portion of the additional header falls within the first prescribed pattern.

18. The computer product of claim 10 , wherein the computer-readable medium has further stored instructions, execution of which by the processor further causes performance of:

receiving an additional header after the plurality of headers are received; and

determining whether a portion of the additional header is related to a portion of a header associated with a flooding attack.