Systems and methods for detecting and tracing denial of service attacks

• US 7,269,850 B2
• Filed: 12/31/2002
• Issued: 09/11/2007
• Est. Priority Date: 12/31/2002
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Govindarajan, Priya, Chiu, Chun-Yang
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): POPHAM, JEFFREY D
• Application Number:
  US10/335,197
• Publication Number:
  US 20040128550A1
• Time in Patent Office: 1,715 Days
• Field of Search: 726 22- 25
• US Class Current: 726/22
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Systems and methods for detecting and tracing a denial-of-service attack are disclosed. One aspect of the systems and methods includes providing a plurality of attack detection modules and a plurality of broker modules operable to communicably couple to a network. The attack detection modules operate to detect a potential denial-of-service attack on network segment. An attack signature for the potential denial of service attack may be forwarded to one or more broker modules on the network segment. The broker modules collectively analyze the data in order to determine a source or sources for the attack.

Claims

1. A method comprising:

receiving an initialization packet from a network source on a network having a network protocol,

sending an initialization acknowledgement packet in response to the initialization packet;

caching information regarding the initialization acknowledgement packet, said information including an initialization acknowledgement packet time;

receiving an acknowledgement packet from the network source, said packet having an acknowledgement arrival time;

comparing the acknowledgement arrival time with the initialization acknowledgement packet time; and

if the acknowledgement arrival time is after the initialization packet and before the initialization acknowledgement packet time then indicating a potential denial-of-service attack.

2. The method of claim 1, wherein the network protocol comprises an IP network protocol.

3. The method of claim 1, wherein the network protocol comprises a TCP/IP network protocol and wherein the initialization packet comprises a SYN packet, the initialization acknowledgement packet comprises a SYN/ACK packet, and the acknowledgement packet comprises an ACK packet.

4. A machine-readable storage medium having machine executable instructions to perform a method for detecting a denial-of-service attack, the method comprising:

receiving an initialization packet from a network source on a network having a network protocol;

sending an initialization acknowledgement packet in response to the initialization packet;

caching information regarding the initialization acknowledgement packet, said information including an initialization acknowledgement packet time;

receiving an acknowledgement packet from the network source, said packet having an acknowledgement arrival time;

comparing the acknowledgement arrival time with the initialization acknowledgement packet time; and

if the acknowledgement arrival time is after the initialization packet and before the initialization acknowledgement packet time the indicating a potential denial-of-service attack.

5. The machine-readable storage medium of claim 4, wherein the network protocol comprises an IP network protocol.

6. The machine-readable storage medium of claim 4, wherein the network protocol comprises a TCP/IP network protocol and wherein the initialization packet comprise a SYN packet, the initialization acknowledgement packet comprises a SYN/ACK packet, and the acknowledgement packet comprises an ACK packet.