Systems and methods for detecting and preventing flooding attacks in a network environment
A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.
1. A method for processing network traffic data comprising:
receiving a packet to initiate a new session associated with an Internet Protocol (IP) address;
taking into account the received packet, determining a rate R at which a number of sessions initiation packets N associated with the IP address are received within a time period t, where R=N÷t;
storing, on a data storage device, a representation of the rate R;
comparing the rate R with a prescribed session rate threshold T;
allowing the packet to pass when the session rate threshold R is less than the prescribed session rate threshold T (R<T); and
classifying the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T (R≧T).
2. The method of claim 1 , wherein the prescribed session rate threshold T is selected for comparison based on a type of the received packet.
3. The method of claim 1 , wherein the prescribed session rate threshold T is network session specific.
4. The method of claim 1 , wherein the prescribed session rate threshold T is source specific with regard to the source of the packet.
5. The method of claim 1 , wherein the prescribed session rate threshold T is configured with relation to time of day.
6. The method of claim 1 , wherein the prescribed session rate threshold T is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.
7. The method of claim 1 , wherein packets classified as possibly associated with a flooding attack are forwarded for additional flooding attack consideration processing.
8. A non-transitory device-readable storage medium including a set of instructions stored thereon which when executed by a processor of a device cause the device to:
receive a packet to initiate a new session associated with an Internet Protocol (IP) address;
taking into account the received packet, determine a rate R at which a number of sessions initiation packets N associated with the IP address are received within a time period t, where R=N÷t;
store, on a data storage device, a representation of the rate R;
compare the rate R with a prescribed session rate threshold T;
allow the packet to pass when the session rate threshold R is less than the prescribed session rate threshold T (R<T); and
classify the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T (R≧T).
9. The non-transitory device-readable storage medium of claim 8 , wherein the prescribed session rate threshold T is selected for comparison based on a type of the received packet.
10. The non-transitory device-readable storage medium of claim 8 , wherein the prescribed session rate threshold T is network session specific.
11. The non-transitory device-readable storage medium of claim 8 , wherein the prescribed session rate threshold T is source specific with regard to the source of the packet.
12. The non-transitory device-readable storage medium of claim 8 , wherein the prescribed session rate threshold T is configured with relation to time of day.
13. The non-transitory device-readable storage medium of claim 8 , wherein the prescribed session rate threshold T is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.
14. The non-transitory device-readable storage medium of claim 8 , wherein packets classified as possibly associated with a flooding attack are forwarded for additional flooding attack consideration processing.
15. A device, comprising:
a processor;
a communication interface for communicating over a network:
a memory device including instructions stored thereon which when executed by the processor, cause the device to:
receive a packet to initiate a new session associated with an Internet Protocol (IP) address;
taking into account the received packet, determine a rate R at which a number of sessions initiation packets N associated with the IP address are received within a time period t, where R=N÷t;
store, on a data storage device, a representation of the rate R;
compare the rate R with a prescribed session rate threshold T;
allow the packet to pass when the session rate threshold R is less than the prescribed session rate threshold T (R<T); and
classify the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T (R≧T).
16. The device of claim 15 , wherein the prescribed session rate threshold T is selected for comparison based on a type of the received packet.
17. The device of claim 15 , wherein the prescribed session rate threshold T is network session specific.
18. The device of claim 15 , wherein the prescribed session rate threshold T is source specific with regard to the source of the packet.
19. The device of claim 15 , wherein the prescribed session rate threshold T is configured with relation to time of day.
20. The device of claim 15 , wherein the prescribed session rate threshold T is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.