Systems and methods for detecting and preventing flooding attacks in a network environment

• US 9,130,978 B2
• Filed: 03/12/2013
• Issued: 09/08/2015
• Est. Priority Date: 07/06/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Wei, Shaohong, Duan, Gang, Chen, Zhong Qiang, Xie, Bing
• Primary Examiner(s): Jiang, Charles C
• Assistant Examiner(s): KAMARA, MOHAMED A
• Application Number:
  US13/795,429
• Publication Number:
  US 20130340078A1
• Time in Patent Office: 910 Days
• Field of Search: 370252-253, 370/230, 370386-392, 370/401, 370/422, 370466-467, 370/469, 726 22- 25
• US Class Current: 1/1
• CPC Class Codes: H04L 1/1835 Buffer management
• CPC Class Codes: H04L 2463/143 Denial of service attacks involving systematic or selective dropping of packets
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.

Claims

1. A method for processing network traffic data comprising:

receiving a packet to initiate a new session associated with an Internet Protocol (IP) address;

taking into account the received packet, determining a rate R at which a number of sessions initiation packets N associated with the IP address are received within a time period t, where R=N÷

t;

storing, on a data storage device, a representation of the rate R;

comparing the rate R with a prescribed session rate threshold T;

allowing the packet to pass when the session rate threshold R is less than the prescribed session rate threshold T (R<

T); and

classifying the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T (R≧

T).

2. The method of claim 1, wherein the prescribed session rate threshold T is selected for comparison based on a type of the received packet.

3. The method of claim 1, wherein the prescribed session rate threshold T is network session specific.

4. The method of claim 1, wherein the prescribed session rate threshold T is source specific with regard to the source of the packet.

5. The method of claim 1, wherein the prescribed session rate threshold T is configured with relation to time of day.

6. The method of claim 1, wherein the prescribed session rate threshold T is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.

7. The method of claim 1, wherein packets classified as possibly associated with a flooding attack are forwarded for additional flooding attack consideration processing.

8. A non-transitory device-readable storage medium including a set of instructions stored thereon which when executed by a processor of a device cause the device to:

receive a packet to initiate a new session associated with an Internet Protocol (IP) address;

taking into account the received packet, determine a rate R at which a number of sessions initiation packets N associated with the IP address are received within a time period t, where R=N÷

t;

store, on a data storage device, a representation of the rate R;

compare the rate R with a prescribed session rate threshold T;

allow the packet to pass when the session rate threshold R is less than the prescribed session rate threshold T (R<

T); and

classify the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T (R≧

T).

9. The non-transitory device-readable storage medium of claim 8, wherein the prescribed session rate threshold T is selected for comparison based on a type of the received packet.

10. The non-transitory device-readable storage medium of claim 8, wherein the prescribed session rate threshold T is network session specific.

11. The non-transitory device-readable storage medium of claim 8, wherein the prescribed session rate threshold T is source specific with regard to the source of the packet.

12. The non-transitory device-readable storage medium of claim 8, wherein the prescribed session rate threshold T is configured with relation to time of day.

13. The non-transitory device-readable storage medium of claim 8, wherein the prescribed session rate threshold T is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.

14. The non-transitory device-readable storage medium of claim 8, wherein packets classified as possibly associated with a flooding attack are forwarded for additional flooding attack consideration processing.

15. A device, comprising:

a processor;

a communication interface for communicating over a network;

a memory device including instructions stored thereon which when executed by the processor, cause the device to;

receive a packet to initiate a new session associated with an Internet Protocol (IP) address;

taking into account the received packet, determine a rate R at which a number of sessions initiation packets N associated with the IP address are received within a time period t, where R=N÷

t;

store, on a data storage device, a representation of the rate R;

compare the rate R with a prescribed session rate threshold T;

allow the packet to pass when the session rate threshold R is less than the prescribed session rate threshold T (R<

T); and

classify the packet as possibly associated with a flooding attack when the session rate threshold R is greater than or equal to the prescribed session rate threshold T (R≧

T).

16. The device of claim 15, wherein the prescribed session rate threshold T is selected for comparison based on a type of the received packet.

17. The device of claim 15, wherein the prescribed session rate threshold T is network session specific.

18. The device of claim 15, wherein the prescribed session rate threshold T is source specific with regard to the source of the packet.

19. The device of claim 15, wherein the prescribed session rate threshold T is configured with relation to time of day.

20. The device of claim 15, wherein the prescribed session rate threshold T is configured with regard to at least two parameters including two or more of packet type, session, packet source, and time of day.