Systems and methods for detecting and preventing flooding attacks in a network environment

• US 20070019543A1
• Filed: 07/06/2005
• Published: 01/25/2007
• Est. Priority Date: 07/06/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Duan, Gang, Xie, Bing, Wei, Shaohong, Chen, Zhongqiang
• Granted Patent: US 7,609,625 B2
• Time in Patent Office: Days
• US Class Current: 370/229
• CPC Class Codes: H04L 1/1835 Buffer management
• CPC Class Codes: H04L 2463/143 Denial of service attacks involving systematic or selective dropping of packets
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.

Claims

1. A method for processing network traffic data, comprising:

receiving a packet; and

determining whether the packet is a previously dropped packet that is being retransmitted.

2. The method of claim 1, further comprising dropping the packet if the packet is not a retransmission of a previously dropped packet.

3. The method of claim 1, wherein the determining comprises comparing the received packet against one or more records in a log, each of the one or more records associating with a previously received packet.

4. The method of claim 3, wherein the determining further comprises:

identifying a first transmission time of the received packet;

identifying a second transmission time of a previously received packet;

calculating a period between the first and second transmission times; and

determining whether the period is within a prescribed threshold.

5. The method of claim 4, wherein the packet is determined to be a previously dropped packet if the period is within the prescribed threshold.

6. The method of claim 1, further comprising:

updating a counter based at least in part on the received packet; and

determining whether the counter exceeds a prescribed threshold.

7. The method of claim 6, wherein the counter comprises a concurrent session counter.

8. The method of claim 6, wherein the counter comprises a rate-based counter.

9. The method of claim 6, wherein the prescribed threshold is data type specific.

10. The method of claim 6, wherein the determining whether the packet is a previously dropped packet that is being retransmitted is performed only when the counter exceeds the prescribed threshold.

11. The method of claim 1, further comprising performing a task based at least in part on a result from the act of determining, the task selected from the group consisting of dropping a packet, terminating a session, and sending a message to a user.

12. The method of claim 1, further comprising determining whether the packet is associated with a flooding attack.

13. The method of claim 1, wherein the packet comprises a header selected from the group consisting of a TCP header, an IP header, an UDP header, and an ICMP header.

14. A system for processing network traffic data, comprising:

means for receiving a packet; and

means for determining whether the packet is a previously dropped packet that is being retransmitted.

15. A computer product includes a computer-readable medium, the computer-readable medium having a set of stored instructions, an execution of which causes a process to be performed, the process comprising:

receiving a packet; and

determining whether the packet is a previously dropped packet that is being retransmitted.

16. A method for processing network traffic content, comprising:

receiving a plurality of headers, the plurality of headers having respective first field values; and

determining whether the first field values of the respective headers form a first prescribed pattern.

17. The method of claim 16, wherein the determining comprises determining whether the first field values of the respective headers are identical.

18. The method of claim 16, wherein the determining comprises determining whether the first field values are sequentially increasing.

19. The method of claim 16, wherein the determining comprises determining whether the first field values are sequentially decreasing.

20. The method of claim 16, wherein the determining comprises:

calculating checksum values for the respective first field values; and

determining whether the checksum values form the first prescribed pattern.

21. The method of claim 16, wherein the plurality of headers are received within a prescribed period.

22. The method of claim 21, wherein the prescribed period comprises an hour or less.

23. The method of claim 16, wherein each of the headers is selected from the group consisting of a TCP header, an IP header, an UDP header, and an ICMP header.

24. The method of claim 16, wherein each of the first field values is selected from the group consisting of a sequence number, a network order, an identification field value, a TCP flag, a TCP option, and an IP option.

25. The method of claim 16, further comprising determining whether second field values of the respective headers form a second prescribed pattern.

26. The method of claim 16, further comprising determining an existence of a flooding attack based at least in part on the determining.

27. The method of claim 16, further comprising performing a task based at least in part on the determining, the task selected from the group consisting of dropping a packet, terminating a session, and sending a message to a user.

28. The method of claim 16, further comprising:

receiving an additional header; and

determining whether a portion of the additional header falls within the first prescribed pattern.

29. The method of claim 16, further comprising:

receiving an additional header after the plurality of headers are received; and

determining whether a portion of the additional header is related to a portion of a header associated with a flooding attack.

30. A system for processing network traffic content, comprising:

means for receiving a plurality of headers, the plurality of headers having respective first field values; and

means for determining whether the first field values of the respective headers form a first prescribed pattern.

31. A computer product includes a computer-readable medium, the computer-readable medium having a set of stored instructions, an execution of which causes a process to be performed, the process comprising:

receiving a plurality of headers, the plurality of headers having respective first field values; and

determining whether the first field values of the respective headers form a first prescribed pattern.

32. A method for processing network traffic content, comprising:

receiving a plurality of packets; and

determining an existence of a flooding attack without tracking each of the plurality of packets.

33. The method of claim 32, wherein the act of determining comprises analyzing at least a portion of a header.

34. The method of claim 33, wherein the act of analyzing comprises determining whether the at least a portion of the header is related to a portion of a header associated with a SYN flooding attack.

35. A system for processing network traffic content, comprising:

means for receiving a plurality of packets; and

means for determining an existence of a flooding attack without tracking each of the plurality of packets.

36. A computer product includes a computer-readable medium, the computer-readable medium having a set of stored instructions, an execution of which causes a process to be performed, the process comprising:

receiving a plurality of packets; and

determining an existence of a flooding attack without tracking each of the plurality of packets.