Detecting and preventing flooding attacks in a network environment

• US 9,635,051 B2
• Filed: 02/29/2016
• Issued: 04/25/2017
• Est. Priority Date: 07/06/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Wei, Shaohong, Duan, Gang, Chen, Zhong Qiang, Xie, Bing
• Primary Examiner(s): KAMARA, MOHAMED A
• Application Number:
  US15/055,995
• Publication Number:
  US 20160294865A1
• Time in Patent Office: 421 Days
• Field of Search: 370252-253, 370230, 370386-392, 370401, 370422, 370466-467, 370469, 726 22- 27
• CPC Class Codes: H04L 1/1835 Buffer management
• CPC Class Codes: H04L 2463/143 Denial of service attacks involving systematic or selective dropping of packets
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.

Claims

1. A computer-implemented method for processing network traffic data in a gateway device for a computer network, the method comprising the steps of:

receiving a packet;

identifying whether the packet complies with a protocol having a retransmission protocol;

responsive to the packet complying, determining whether the packet is a previously dropped packet that is being retransmitted according to the retransmission protocol; and

dropping the packet responsive to the packet not being a retransmission of a previously dropped packet.

2. The method of claim 1, further comprising:

forwarding the packet as safe responsive to the packet being a retransmission of the previously dropped packet.

3. The method of claim 1, further comprising:

flagging the packet as potentially unsafe or as unsafe, responsive to multiple packets being dropped and of a certain characteristic in common.

4. The method of claim 1, further comprising:

flagging the packet as potentially unsafe or as unsafe, responsive to multiple packets being dropped and of a certain characteristic in common.

5. The method of claim 1, further comprising:

flagging the packet as part of a flooding attack, responsive to multiple packets being dropped and of a certain characteristic in common.

9. The method of claim 1, further comprising:

flagging the packet as part of a flooding attack, responsive to multiple packets being dropped and of a certain characteristic in common.

6. A non-transitory device-readable storage medium including a set of instructions stored thereon which when executed by a processor of a device, performs a method for processing network traffic data in a gateway device for a computer network, the method comprising the steps of:

receiving a packet;

identifying whether the packet complies with a protocol having a retransmission protocol;

responsive to the packet complying, determining whether the packet is a previously dropped packet that is being retransmitted according to the retransmission protocol; and

dropping the packet responsive to the packet not being a retransmission of a previously dropped packet.

7. The device-readable medium of claim 6, wherein the method further comprises:

forwarding the packet as safe responsive to the packet being a retransmission of the previously dropped packet.

8. The device-readable medium of claim 6, further comprising:

flagging the packet as potentially unsafe or as unsafe, responsive to multiple packets being dropped and of a certain characteristic in common.

10. A gate way device having at least some hardware for processing network traffic data for a computer network, the method comprising the steps of:

a processor;

a network interface; and

a memory device, storing;

a first module to receive a packet;

a second module to identify whether the packet complies with a protocol having a retransmission protocol;

a third module to, responsive to the packet complying, determine whether the packet is a previously dropped packet that is being retransmitted according to the retransmission protocol; and

a fourth module to drop the packet responsive to the packet not being a retransmission of a previously dropped packet.