IP Library › Granted Patent US 8,347,385
Granted Patent B2
US 8,347,385 · App. 12/640,985 · Granted Jan 1, 2013

Systems and methods for detecting and preventing flooding attacks in a network environment

Assignee: Fortinet, Inc.
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,347,385
App. No.
12/640,985
Granted
Jan 1, 2013
Kind
B2
Abstract

A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.

Claims (48)

1. A method for processing network traffic content, comprising:

receiving a plurality of packets;

determining an existence of a flooding attack without tracking each of the plurality of packets; and

dropping packets of the plurality of packets associated with the determined flooding attack; and

wherein:

the determining comprises comparing each received packet against one or more records in a log, each of the one or more records associating with a previously received packet; and

the determining further comprises:

identifying a first transmission time of a received packet;

identifying a second transmission time of a previously received packet;

calculating a period between the first and second transmission times;

determining whether the period is within a prescribed threshold; and

when the period is within the prescribed threshold, the received packet is determined to be a previously dropped packet.

2. The method of claim 1 , wherein the determining comprises analyzing at least a portion of a header.

3. The method of claim 2 , wherein the analyzing comprises:

determining whether the at least a portion of the header is related to a portion of a header associated with a SYN flooding attack.

4. A system, comprising:

a processor;

a communication interface for communicating over a network:

a memory device including instructions stored thereon which when executed by the processor, cause the system to:

receive a plurality of packets from a network via the communication interface;

determine an existence of a flooding attack within the received plurality of packets without tracking each of the plurality of packets;

drop packets of the plurality of packets associated with the determined flooding attack; and

wherein:

the determining comprises comparing each received packet against one or more records in a log, each of the one or more records associating with a previously received packet; and

the determining further comprises:

identifying a first transmission time of a received packet;

identifying a second transmission time of a previously received packet;

calculating a period between the first and second transmission times;

determining whether the period is within a prescribed threshold; and

when the period is within the prescribed threshold, the received packet is determined to be a previously dropped packet.

5. The system of claim 4 , wherein the determining comprises analyzing at least a portion of a header.

6. The system of claim 5 , wherein the analyzing comprises:

determining whether the at least a portion of the header is related to a portion of a header associated with a SYN flooding attack.

7. A non-transitory computer-readable storage medium including a set of instructions stored thereon which when executed by a processor of a computer cause the computer to:

receive a plurality of packets;

identify an existence of a flooding attack without tracking each of the plurality of packets; and

drop packets of the plurality of packets associated with the determined flooding attack;

and wherein:

the determining comprises comparing each received packet against one or more records in a log, each of the one or more records associating with a previously received packet; and

the determining further comprises:

identifying a first transmission time of a received packet;

identifying a second transmission time of a previously received packet;

calculating a period between the first and second transmission times;

determining whether the period is within a prescribed threshold: and

when the period is within the prescribed threshold, the received packet is determined to be a previously dropped packet.

8. The non-transitory computer-readable storage medium of claim 7 , wherein the determining comprises analyzing at least a portion of a header.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the analyzing comprises:

determining whether the at least a portion of the header is related to a portion of a header associated with a SYN flooding attack.

Continuity (3)
Continuation 12566371 · Sep 24, 2009
Continuation 11176494 · Jul 6, 2005
Related Publication 20100122344A1 · May 13, 2010