System and method for detecting and countering a network attack

• US 20040054925A1
• Filed: 09/13/2002
• Published: 03/18/2004
• Est. Priority Date: 09/13/2002
• Status: Abandoned Application

• Current Assignee: Cyber Operations LLC
• Original Assignee: Cyber Operations LLC
• Inventors: Anton, Richard N., Etheridge, James K.
• Application Number:
  US10/243,631
• Publication Number:
  US 20040054925A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Protecting a host network from a flood-type denial of service attack by performing statistical analysis of data packets in the network. The statistical analysis comprises comparing evaluated items in the data packets to threshold values and detecting the attack when the statistical items exceed the threshold value. A countermeasure can be initiated to protect the host network from the attack.

Claims

1. A computer-implemented method for detecting a flood-type denial of service attack against a host network, comprising the steps of:

hashing a data packet parameter of data packets in the network;

calculating a standard deviation of the hash table entries;

determining whether the standard deviation exceeds a threshold value; and

detecting the attack in response to a determination that the standard deviation is less than the threshold value.

2. The method according to claim 1, wherein the parameter value comprises a source IP address.

3. The method according to claim 1, wherein said sorting step comprises incrementing the hash table entries corresponding to the sortable results.

4. The method according to claim 1, further comprising the step of removing an entry from the hash table based on an age of the data packet corresponding to the removed entry.

5. The method according to claim 1, further comprising the step of decaying an entry in the hash table over time.

6. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 1.

24. The method according to claim 1, further comprising the step of removing an entry form the hash table based on the quantity of entries in the hash table.

7. A computer-implemented method for detecting a flood-type denial of service attack against a host network, comprising the steps of:

identifying a parameter value for data packets in the network;

incrementing a histogram corresponding to the identified parameter value;

determining whether a portion of the histogram exceeds a threshold value; and

detecting the attack in response to a determination that the portion of the histogram exceeds the threshold value.

8. The method according to claim 7, wherein the parameter value comprises a protocol.

9. The method according to claim 7, wherein the parameter value comprises a protocol flag.

10. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 7.

11. A computer-implemented method for detecting a flood-type denial of service attack against a host network, comprising the steps of:

counting errors associated with data packets in the network;

determining whether the error count exceeds a threshold value; and

detecting the attack in response to a determination that the error count exceeds the threshold value.

12. The method according to claim 11, further comprising the step of removing an error from the error count based on an age of the data packet associated with the removed error.

13. The method according to claim 11, further comprising the step of decaying an error in the error count over time.

14. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 11.

15. A computer-implemented method for detecting a flood-type denial of service attack against a host network, comprising the steps of:

calculating a ratio of incoming to outgoing data packets for a computer of the network;

determining whether the ratio exceeds a threshold value; and

detecting the attack in response to a determination that the ratio exceeds the threshold value.

16. The method according to claim 15, further comprising the steps of:

determining a source of the attack; and

initiating a countermeasure against the source of the attack.

17. The method according to claim 16, wherein said initiating step comprises the step of preventing data packets from the source of the attack from entering the network.

18. The method according to claim 16, wherein said initiating step comprises the step of preventing data packets having a common port from entering the network.

19. The method according to claim 16, wherein said initiating step comprises the step of preventing data packets having a common protocol from entering the network.

20. The method according to claim 16, wherein said initiating step comprises the step of preventing data packets from reaching a target destination.

21. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 15.

22. A computer-implemented method for detecting a flood-type denial of service attack against a host network, comprising the steps of:

calculating a ratio of incoming and outgoing data packets for a first computer of the network to incoming and outgoing data packets for a second computer of the network;

determining whether the ratio exceeds a threshold value; and

detecting the attack in response to a determination that the ratio exceeds the threshold value.

23. The method according to claim 22, further comprising the steps of:

determining a source of the attack; and

initiating a countermeasure against the source of the attack.