Systems and methods for detecting and preventing flooding attacks in a network environment
A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.
1. A method for processing network traffic content, comprising:
receiving a plurality of packets;
determining an existence of a flooding attack without tracking each of the plurality of packets; and
dropping packets of the plurality of packets associated with the determined flooding attack; and
wherein:
the determining comprises comparing each received packet against one or more records in a log, each of the one or more records associating with a previously received packet; and
the determining further comprises:
identifying a first transmission time of a received packet;
identifying a second transmission time of a previously received packet;
calculating a period between the first and second transmission times;
determining whether the period is within a prescribed threshold; and
when the period is within the prescribed threshold, the received packet is determined to be a previously dropped packet.
2. The method of claim 1 , wherein the determining comprises analyzing at least a portion of a header.
3. The method of claim 2 , wherein the analyzing comprises:
determining whether the at least a portion of the header is related to a portion of a header associated with a SYN flooding attack.
4. A system, comprising:
a processor;
a communication interface for communicating over a network:
a memory device including instructions stored thereon which when executed by the processor, cause the system to:
receive a plurality of packets from a network via the communication interface;
determine an existence of a flooding attack within the received plurality of packets without tracking each of the plurality of packets;
drop packets of the plurality of packets associated with the determined flooding attack; and
wherein:
the determining comprises comparing each received packet against one or more records in a log, each of the one or more records associating with a previously received packet; and
the determining further comprises:
identifying a first transmission time of a received packet;
identifying a second transmission time of a previously received packet;
calculating a period between the first and second transmission times;
determining whether the period is within a prescribed threshold; and
when the period is within the prescribed threshold, the received packet is determined to be a previously dropped packet.
5. The system of claim 4 , wherein the determining comprises analyzing at least a portion of a header.
6. The system of claim 5 , wherein the analyzing comprises:
determining whether the at least a portion of the header is related to a portion of a header associated with a SYN flooding attack.
7. A non-transitory computer-readable storage medium including a set of instructions stored thereon which when executed by a processor of a computer cause the computer to:
receive a plurality of packets;
identify an existence of a flooding attack without tracking each of the plurality of packets; and
drop packets of the plurality of packets associated with the determined flooding attack;
and wherein:
the determining comprises comparing each received packet against one or more records in a log, each of the one or more records associating with a previously received packet; and
the determining further comprises:
identifying a first transmission time of a received packet;
identifying a second transmission time of a previously received packet;
calculating a period between the first and second transmission times;
determining whether the period is within a prescribed threshold: and
when the period is within the prescribed threshold, the received packet is determined to be a previously dropped packet.
8. The non-transitory computer-readable storage medium of claim 7 , wherein the determining comprises analyzing at least a portion of a header.
9. The non-transitory computer-readable storage medium of claim 8 , wherein the analyzing comprises:
determining whether the at least a portion of the header is related to a portion of a header associated with a SYN flooding attack.