Systems and methods for detecting and preventing flooding attacks in a network environment

• US 9,100,423 B2
• Filed: 05/20/2014
• Issued: 08/04/2015
• Est. Priority Date: 07/06/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Wei, Shaohong, Duan, Gang, Chen, Zhong Qiang, Xie, Bing
• Primary Examiner(s): Jiang, Charles C
• Assistant Examiner(s): KAMARA, MOHAMED A
• Application Number:
  US14/282,814
• Publication Number:
  US 20140283043A1
• Time in Patent Office: 441 Days
• Field of Search: 370252-253, 370/230, 370386-392, 370/401, 370/422, 370466-467, 370/469, 726 22- 25
• US Class Current: 1/1
• CPC Class Codes: H04L 1/1835 Buffer management
• CPC Class Codes: H04L 2463/143 Denial of service attacks involving systematic or selective dropping of packets
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.

Claims

1. A method for processing network traffic data by a network switching device, the method comprising:

receiving a packet, by a network interface of the network switching device, to initiate a new session from an Internet Protocol (IP) address;

determining, on the network switching device, a number N of concurrent sessions for active concurrent sessions associated with the IP address; and

when the number N of concurrent sessions for active concurrent sessions associated with the IP address is less than a concurrent session threshold T₁;

determining, on the network switch device, a rate R at which the number of sessions N are received within a time period t including a session of the received packet, where R=N÷

t;

when the session rate threshold R is less than the prescribed session rate threshold T₂ (R<

T₂), passing the packet from the network switching device toward an intended recipient; and

classifying the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T₂ (R≧

T₂) and performing a preventative action with regard to the packet.

2. The method of claim 1, wherein the concurrent session threshold rate T₁ is adaptive to a time of day to allow for a higher concurrent session threshold rate T₁ during higher demand periods and a lower concurrent session threshold rate T₁ during lower demand periods.

3. The method of claim 2, wherein the network switching device maintains a log of network switching device packet processing activity and the network switching device includes a process that determines the concurrent session threshold rate T₁ based at least in part on the log of network switching device packet processing activity.

4. The method of claim 3, wherein the process that determines the concurrent session threshold rate T₁ based at least in part on the log of network switching device packet processing activity determines a plurality of concurrent session threshold rates T₁, each of the plurality concurrent session threshold rates T₁ associated with a source network address from which sessions were initiated, an applicable concurrent threshold rate T1 identified for a current session based on a source network address from which the packet was received.

5. The method of claim 1, wherein the prescribed session rate threshold T₂ is selected for comparison based on a type of the received packet.

6. The method of claim 1, wherein the prescribed session rate threshold T₂ is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.

7. The method of claim 1, wherein performing a preventative action with regard to the packet includes at least one of forwarding the packet for additional flooding attack consideration processing and forwarding the packet to a content detection module.

8. A non-transitory device-readable storage medium including a set of instructions stored thereon which when executed by a processor of a network switching device cause the network switching device to:

receive a packet, by a network interface of the network switching device, to initiate a new session from an Internet Protocol (IP) address;

determine, on the network switching device, a number N of concurrent sessions for active concurrent sessions associated with the IP address; and

when the number N of concurrent sessions for active concurrent sessions associated with the IP address is less than a concurrent session threshold T₁;

determine, on the network switch device, a rate R at which the number of sessions N are received within a time period t including a session of the received packet, where R=N÷

t;

when the session rate threshold R is less than the prescribed session rate threshold T₂ (R<

T₂), pass the packet from the network switching device toward an intended recipient; and

classify the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T₂ (R≧

T₂) and perform a preventative action with regard to the packet.

9. The non-transitory device-readable storage medium of claim 8, wherein the concurrent session threshold rate T₁ is adaptive to a time of day to allow for a higher concurrent session threshold rate T₁ during higher demand periods and a lower concurrent session threshold rate T₁ during lower demand periods.

10. The non-transitory device-readable storage medium of claim 9, wherein the network switching device maintains a log of network switching device packet processing activity and the network switching device includes a process that determines the concurrent session threshold rate T₁ based at least in part on the log of network switching device packet processing activity.

11. The non-transitory device-readable storage medium of claim 10, wherein the process that determines the concurrent session threshold rate T₁ based at least in part on the log of network switching device packet processing activity determines a plurality of concurrent session threshold rates T₁, each of the plurality concurrent session threshold rates T₁ associated with a source network address from which sessions were initiated, an applicable concurrent threshold rate T1 identified for a current session based on a source network address from which the packet was received.

12. The non-transitory device-readable storage medium of claim 8, wherein the prescribed session rate threshold T₂ is selected for comparison based on a type of the received packet.

13. The non-transitory device-readable storage medium of claim 8, wherein the prescribed session rate threshold T₂ is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.

14. The non-transitory device-readable storage medium of claim 8, wherein performing a preventative action with regard to the packet includes at least one of forwarding the packet for additional flooding attack consideration processing and forwarding the packet to a content detection module.

15. A network switching device, comprising:

a processor;

a communication interface for communicating over a network;

a memory device including instructions stored thereon which when executed by the processor, cause the device to;

receive a packet, by the communication interface of the network switching device, to initiate a new session from an Internet Protocol (IP) address;

determine, on the network switching device, a number N of concurrent sessions for active concurrent sessions associated with the IP address; and

when the number N of concurrent sessions for active concurrent sessions associated with the IP address is less than a concurrent session threshold T₁;

determine, on the network switch device, a rate R at which the number of sessions N are received within a time period t including a session of the received packet, where R=N÷

t;

when the session rate threshold R is less than the prescribed session rate threshold T₂ (R<

T₂), pass the packet from the network switching device toward an intended recipient; and

classify the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T₂ (R≧

T₂) and perform a preventative action with regard to the packet.

16. The network switching device of claim 15, wherein:

the concurrent session threshold rate T₁ is adaptive to a time of day to allow for a higher concurrent session threshold rate T₁ during higher demand periods and a lower concurrent session threshold rate T₁ during lower demand periods; and

the network switching device maintains a log of network switching device packet processing activity and the network switching device includes a process that determines the concurrent session threshold rate T₁ based at least in part on the log of network switching device packet processing activity.

17. The network switching device of claim 16, wherein the process that determines the concurrent session threshold rate T₁ based at least in part on the log of network switching device packet processing activity determines a plurality of concurrent session threshold rates T₁, each of the plurality concurrent session threshold rates T₁ associated with a source network address from which sessions were initiated, an applicable concurrent threshold rate T1 identified for a current session based on a source network address from which the packet was received.

18. The network switching device of claim 15, wherein the prescribed session rate threshold T₂ is selected for comparison based on a type of the received packet.

19. The network switching device of claim 15, wherein the prescribed session rate threshold T₂ is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.

20. The network switching device of claim 15, wherein performing a preventative action with regard to the packet includes at least one of forwarding the packet for additional flooding attack consideration processing and forwarding the packet to a content detection module.