WO2004010259A2 - Denial of service defense by proxy - Google Patents

Denial of service defense by proxy Download PDF

Info

Publication number
WO2004010259A2
WO2004010259A2 PCT/US2003/022841 US0322841W WO2004010259A2 WO 2004010259 A2 WO2004010259 A2 WO 2004010259A2 US 0322841 W US0322841 W US 0322841W WO 2004010259 A2 WO2004010259 A2 WO 2004010259A2
Authority
WO
WIPO (PCT)
Prior art keywords
host
firewall
router
defensive
status
Prior art date
Application number
PCT/US2003/022841
Other languages
French (fr)
Other versions
WO2004010259A3 (en
Inventor
Donald E. Eastlake, Iii
Original Assignee
General Instrument Corporation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by General Instrument Corporation filed Critical General Instrument Corporation
Priority to AU2003256662A priority Critical patent/AU2003256662A1/en
Priority to CA002492494A priority patent/CA2492494A1/en
Publication of WO2004010259A2 publication Critical patent/WO2004010259A2/en
Publication of WO2004010259A3 publication Critical patent/WO2004010259A3/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
    • G06F11/324—Display of status information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service

Definitions

  • the present invention relates to the Internet. More specifically, the present invention relates to Internet security features.
  • DOS Denial of service
  • DOS attacks are one type of attack that are an increasing problem. While some DOS attacks exploit subtle flaws in the host being attacked, the most basic low level attacks are based on bandwidth exhaustion. That is, the links (usually one) to the host being attacked are so saturated with DOS traffic that legitimate packets cannot get through. Because such denial of service attacks do not depend on any flaw at the target host, no fix at the host can solve them.
  • a DOS target host or target local network is connected to the Internet via a router or firewall such that there is considerably greater bandwidth between the Internet and the firewall/router than there is between the firewall/router and the target host.
  • a low level DOS attack the flood of traffic on the one or more connections between the firewall/router and the Internet cannot be supported by the smaller connection between the firewall/router and the target, which results in high packet loss at the firewall/router. Legitimate packets that are dropped are denied transport to the host which leads to the general denial of Internet service.
  • Such attacks become a bandwidth contest. If the attacker has more bandwidth at their command than the link (or links) to the target, the attacker wins unless effective countermeasures have been implemented at the defensive firewall/router.
  • Narrower blocking may consist of throwing away all packets from a particular block of IP source addresses. However, this can only be done after it has been determined that an attack is coming from those particular addresses.
  • This invention shields a host or local network from excess traffic through the use of defensive proxy.
  • This proxy occurs before the limited bandwidth link or links which connect the host or local network to the Internet, and thus shields this link or links from becoming saturated with traffic, particularly illegitimate traffic.
  • the defensive proxy does so by simulating some aspects of the host or local network. Through this simulation, it can respond directly to traffic without forwarding that traffic over the limited bandwidth link or to the host or local network which may be under denial of service attack.
  • FIG. 1 is a block diagram of an Internet communication network coupled to a host.
  • FIG. 2 is a block diagram of an Internet communication network coupled to a local network.
  • FIG. 3 is a flow diagram of one aspect of the Internet security feature in accordance with the preferred embodiment of the present invention.
  • FIG. 4 is a flow diagram of an alternate embodiment of the present invention.
  • FIG. 1 and FIG. 2 are block diagrams of typical connections to an Internet communication network.
  • the Internet communication network 9 comprises a plurality of external servers 13a...13n and the Internet communication infrastructure 12, which includes one or more intermediate computer servers, routers and the fiber optic, coaxial, wireless or telephone interconnections between them (not shown).
  • the Internet communication infrastructure 12 may be connected to a defensive firewall/router 10 and a host server 11 as shown in FIG. 1, or a defensive firewall/router 10 coupled to a local network 14 comprising a local firewall/router 15 and one or more host servers 1 la-1 In as shown in FIG. 2.
  • the firewall/router 10 acts as a defensive proxy between the host server 11 (or local network 14) and any external servers 13a-13n connected to the Internet infrastructure 12 to protect the host server 11 (or local network 14) from attack, such as a DOS attack. Acting as a proxy, the defensive firewall/router 10 monitors and intercepts any and all requests that come in from the Internet infrastructure 12.
  • the present invention used in the defense of a DOS attack will be discussed hereinafter for exemplary purposes.
  • many types of traffic flood attack on the host server 11 or local network 14 which is designed to eliminate the ability of the host server 11 or local network 14 to respond to the requests from one or more external servers 13 a ...13n may be defended against in a similar manner.
  • the firewall/router 10 monitors and intercepts all requests (pings) to the host server 11.
  • a ping is a standard network utility which is used to determine if a remote device, such as a host server 11, can be reached via the Internet and, if so, how fast the current connection is.
  • DOS attacks utilize these pings to flood the connection L between the host server 11 and the firewall/router 10 or the local network 14. The attacker attempts to exhaust the bandwidth of this connection L, thereby leading to packet loss and denial of service to legitimate packets.
  • the defensive firewall/router 10 acting as a proxy uses a defense process to protect against such attacks while still providing useful information in response to legitimate pings. This defense process 200 of the present invention is illustrated in the flow diagram of FIG. 3.
  • an external server 13a connected to the Internet infrastructure 12 requests (pings) the status of the host server 11 (Step 202).
  • the request rate is limited based upon the granularity or accuracy set by the firewall/router 10 policy but no more often than the frequency of actual pings to the host server 11 or the address or local network 14, and may be set as desired by the system administrator.
  • the periodicity of the request by the firewall/router 10 may be based on a predetermined time period or based on the number of received pings from external servers 13a...13n.
  • the defensive firewall/router 10 sends a request (ping) to the host server 11 or the address on the local network 14 (step 206)
  • the host server 11 or address on the local network 14 responds (or not) to the defensive firewall/router 10 to indicate its status (Step 208).
  • the defensive firewall/router 10 stores the details of the reply, (or lack thereof), (Step 210) such as length of time until response, whether or not any response was received in a reasonable length of time, (as set defensive firewall/router policy), and for the local network case, which (if any) of such error indications as "host unreachable" or "network unreachable” was returned.
  • the defensive firewall/router 10 responds to the requesting external server 13a (Step 212) based on the stored status from the most recent ping to the host server 11 or address on the local network.
  • the defensive firewall/router 10 acting as a proxy for the host server 10 or the local network 14 in accordance with the present invention defends the host server 11 or local network 14 against attacks that attempt to exhaust all communication capacity or memory, or consume all processor capacity of the host server 10 or the local network 14. Eliminating the forwarding of requests (pings) in such a manner ensures that only a limited number of packets are responded to (i.e. a limited rate) by the host server 10 or local network 14.
  • steps 206-210 may be implemented after receiving a ping as shown, or may be implemented prior to step 202, and before any pings are received.
  • FIG.4 Another example of how the present invention may be utilized to defend against attacks on a host server is illustrated in the flow diagrams of FIG.4.
  • S YN synchronize/start
  • the host server 11 or local network 14 is sent packets that ask it to respond to an external server 13a-13n with an incorrect IP address. As it responds, it is flooded with the requests.
  • the host server 11 or local network 14 keeps track of these requests and waits for a response until the requests begin to time-out and are dropped. During the waiting period, the host server 11 or local network 14 is consumed by the requests and cannot respond to legitimate requests.
  • the defensive firewall/router 10 of the present invention implements a procedure 400 to cope with such a SYN attack.
  • the defensive firewall/router 10 periodically implements the same steps 206-210 to determine the status of the host server 11 or the address of the local network 14 and store the status in memory. The period of the status check may be set as desired by the system administrator.
  • the defensive firewall/router 10 receives a SYN packet from an external server 13a-13n (Step 408).
  • the defensive firewall/router 10 utilizes the pre-stored status of the host server 11 or address of the local network 14 and responds to the SYN packet with an error (Step 410) or with a SYN/ACK on behalf of the host server 11 or the address of the local network 14 (Step 412). In the event of a SYN/ACK response (Step 412) the defensive firewall/router 10 enters a "pending connection" state and activates a timer. If the response to the SYN packet fails or the connection establishment attempt times out, no data packets are sent by the firewall/router 10 to the host server 11 or the address of the local network 14, and the pending connection state of the defensive firewall/router 10 is cleared (Step 414).
  • the firewall/router 10 tries to complete the "TCP three-way hand shake" with the host server 11 (or the address on the local network 14) and the external server 13a-13n (Step 418). If the hand-shake succeeds, the data packets are forwarded to and from the host server 11 (or the address on the local network 14) by the defensive firewall/router 10 (Step 420) with appropriate header translations. Otherwise, the defensive firewall/router 10 sends a reset to the host sever 11 , (or the address on the local network), and external server 13a- 13n and clears its pending connection state.
  • the need to increase the capacity of SYN ACK queue is greatly reduced. Since the host server 11 or address on the local network 14 never receives a SYN packet until a TCP hand-shake is established, the concern regarding flooding the host server 11 or the address on the local network with SYN packets and the resulting attempts to respond thereto disappear.

Abstract

A method for defending a host, which is coupled to the Internet via a defensive firewall/router, against a denial of service attack, comprises periodically determining the status of the host; storing the status of the host; receiving at the defensive firewall/router a request from an entity on the Internet for service from the host; and responding to the entity in accordance with the stored status. The period that is set is not related to the request.

Description

[0001 ] DENIAL OF SERVICE DEFENSE BY PROXY
[0002] BACKGROUND
[0003] The present invention relates to the Internet. More specifically, the present invention relates to Internet security features.
[0004] The use of the Internet by both individuals and businesses has increased dramatically during the last few years. One area that has seen particularly robust growth is the introduction by cable television providers of Internet service over the existing cable television infrastructure. This type of system typically known as "always on, rarely protected" is used extensively in homes, schools, libraries and other venues without trained system administration and security staff. This has exacerbated problems caused by individuals attempting to bring down computer systems connected to the Internet in such a manner.
[0005] Denial of service (DOS) attacks, for example, are one type of attack that are an increasing problem. While some DOS attacks exploit subtle flaws in the host being attacked, the most basic low level attacks are based on bandwidth exhaustion. That is, the links (usually one) to the host being attacked are so saturated with DOS traffic that legitimate packets cannot get through. Because such denial of service attacks do not depend on any flaw at the target host, no fix at the host can solve them.
[0006] Typically, a DOS target host or target local network is connected to the Internet via a router or firewall such that there is considerably greater bandwidth between the Internet and the firewall/router than there is between the firewall/router and the target host. In a low level DOS attack, the flood of traffic on the one or more connections between the firewall/router and the Internet cannot be supported by the smaller connection between the firewall/router and the target, which results in high packet loss at the firewall/router. Legitimate packets that are dropped are denied transport to the host which leads to the general denial of Internet service. [0007] With the current state of the Internet, such attacks become a bandwidth contest. If the attacker has more bandwidth at their command than the link (or links) to the target, the attacker wins unless effective countermeasures have been implemented at the defensive firewall/router.
[0008] Countermeasures that have been taken thus far have been quite crude and damaging, such as blocking all Internet Control Message Protocol (ICMP) echo packets, since the packets are used by some denial of service tools. Such blockage, though, stops legitimate use of the
"ping" traceroute facilities for network management. Narrower blocking may consist of throwing away all packets from a particular block of IP source addresses. However, this can only be done after it has been determined that an attack is coming from those particular addresses.
[0009] Accordingly, there exists a need for an improved method of defending against attacks on a host server.
[0010] SUMMARY AND OBJECTS OF THE INVENTION
[0011] This invention shields a host or local network from excess traffic through the use of defensive proxy. This proxy occurs before the limited bandwidth link or links which connect the host or local network to the Internet, and thus shields this link or links from becoming saturated with traffic, particularly illegitimate traffic. The defensive proxy does so by simulating some aspects of the host or local network. Through this simulation, it can respond directly to traffic without forwarding that traffic over the limited bandwidth link or to the host or local network which may be under denial of service attack.
[0012] BRIEF DESCRIPTION OF THE DRAWINGS
[0013] FIG. 1 is a block diagram of an Internet communication network coupled to a host.
[0014] FIG. 2 is a block diagram of an Internet communication network coupled to a local network.
[0015] FIG. 3 is a flow diagram of one aspect of the Internet security feature in accordance with the preferred embodiment of the present invention.
[0016] FIG. 4 is a flow diagram of an alternate embodiment of the present invention.
[0017] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0018] The preferred embodiment will be described with reference to the drawing figures where like numerals represent like elements throughout.
[0019] FIG. 1 and FIG. 2 are block diagrams of typical connections to an Internet communication network. As shown in FIG. 1 , the Internet communication network 9 comprises a plurality of external servers 13a...13n and the Internet communication infrastructure 12, which includes one or more intermediate computer servers, routers and the fiber optic, coaxial, wireless or telephone interconnections between them (not shown). The Internet communication infrastructure 12 may be connected to a defensive firewall/router 10 and a host server 11 as shown in FIG. 1, or a defensive firewall/router 10 coupled to a local network 14 comprising a local firewall/router 15 and one or more host servers 1 la-1 In as shown in FIG. 2. It should be noted that the local network 14 may comprise any one of an almost unlimited number of configurations and FIG.2 should not be taken to limit the scope of the present invention. [0020] In accordance with the present invention, the firewall/router 10 acts as a defensive proxy between the host server 11 (or local network 14) and any external servers 13a-13n connected to the Internet infrastructure 12 to protect the host server 11 (or local network 14) from attack, such as a DOS attack. Acting as a proxy, the defensive firewall/router 10 monitors and intercepts any and all requests that come in from the Internet infrastructure 12. The present invention used in the defense of a DOS attack, will be discussed hereinafter for exemplary purposes. However, many types of traffic flood attack on the host server 11 or local network 14 which is designed to eliminate the ability of the host server 11 or local network 14 to respond to the requests from one or more external servers 13 a ...13n may be defended against in a similar manner.
[0021] The firewall/router 10 monitors and intercepts all requests (pings) to the host server 11. A ping is a standard network utility which is used to determine if a remote device, such as a host server 11, can be reached via the Internet
Figure imgf000004_0001
and, if so, how fast the current connection is. As stated hereinbefore, DOS attacks utilize these pings to flood the connection L between the host server 11 and the firewall/router 10 or the local network 14. The attacker attempts to exhaust the bandwidth of this connection L, thereby leading to packet loss and denial of service to legitimate packets. In accordance with the present invention, the defensive firewall/router 10 acting as a proxy uses a defense process to protect against such attacks while still providing useful information in response to legitimate pings. This defense process 200 of the present invention is illustrated in the flow diagram of FIG. 3.
[0022] Referring to FIG. 3, an external server 13a connected to the Internet infrastructure 12 requests (pings) the status of the host server 11 (Step 202). The defensive firewall/router 10, connected to the Internet infrastructure 12 through one or more connection(s) W, receives the requests from the external server 13a (Step 204). In accordance with a limited request rate, the defensive firewall/router 10 requests (pings) the status of the host server 11 or local network 14 (Step 206).
[0023] The request rate is limited based upon the granularity or accuracy set by the firewall/router 10 policy but no more often than the frequency of actual pings to the host server 11 or the address or local network 14, and may be set as desired by the system administrator. The more accurate the firewall/router 10 policy needs to be to respond to the requests (pings) received from external servers 13a...13n, the more the firewall/router 10 requests (pings) the host server 11 or the address on the local network 14. The periodicity of the request by the firewall/router 10 may be based on a predetermined time period or based on the number of received pings from external servers 13a...13n.
[0024] After the defensive firewall/router 10 sends a request (ping) to the host server 11 or the address on the local network 14 (step 206), the host server 11 or address on the local network 14 responds (or not) to the defensive firewall/router 10 to indicate its status (Step 208). The defensive firewall/router 10 stores the details of the reply, (or lack thereof), (Step 210) such as length of time until response, whether or not any response was received in a reasonable length of time, (as set defensive firewall/router policy), and for the local network case, which (if any) of such error indications as "host unreachable" or "network unreachable" was returned. The defensive firewall/router 10 responds to the requesting external server 13a (Step 212) based on the stored status from the most recent ping to the host server 11 or address on the local network.
[0025] The defensive firewall/router 10 acting as a proxy for the host server 10 or the local network 14 in accordance with the present invention defends the host server 11 or local network 14 against attacks that attempt to exhaust all communication capacity or memory, or consume all processor capacity of the host server 10 or the local network 14. Eliminating the forwarding of requests (pings) in such a manner ensures that only a limited number of packets are responded to (i.e. a limited rate) by the host server 10 or local network 14. [0026] It should be noted that steps 206-210 may be implemented after receiving a ping as shown, or may be implemented prior to step 202, and before any pings are received. It is only necessary that the status of the host server 11 or address on the local network 14 be updated at a rate, (periodically or aperiodically), as set by the system administrator. [0027] Another example of how the present invention may be utilized to defend against attacks on a host server is illustrated in the flow diagrams of FIG.4. As those skilled in the art realize, a synchronize/start (S YN) flooding attack keeps the targeted machine (host server 11 or local network 14) responding back to a nonexistent system. The host server 11 or local network 14 is sent packets that ask it to respond to an external server 13a-13n with an incorrect IP address. As it responds, it is flooded with the requests. The host server 11 or local network 14 keeps track of these requests and waits for a response until the requests begin to time-out and are dropped. During the waiting period, the host server 11 or local network 14 is consumed by the requests and cannot respond to legitimate requests.
[0028] Accordingly, the defensive firewall/router 10 of the present invention implements a procedure 400 to cope with such a SYN attack. The defensive firewall/router 10 periodically implements the same steps 206-210 to determine the status of the host server 11 or the address of the local network 14 and store the status in memory. The period of the status check may be set as desired by the system administrator. The defensive firewall/router 10 receives a SYN packet from an external server 13a-13n (Step 408). The defensive firewall/router 10 utilizes the pre-stored status of the host server 11 or address of the local network 14 and responds to the SYN packet with an error (Step 410) or with a SYN/ACK on behalf of the host server 11 or the address of the local network 14 (Step 412). In the event of a SYN/ACK response (Step 412) the defensive firewall/router 10 enters a "pending connection" state and activates a timer. If the response to the SYN packet fails or the connection establishment attempt times out, no data packets are sent by the firewall/router 10 to the host server 11 or the address of the local network 14, and the pending connection state of the defensive firewall/router 10 is cleared (Step 414). If the SYN packet succeeds, the firewall/router 10 tries to complete the "TCP three-way hand shake" with the host server 11 (or the address on the local network 14) and the external server 13a-13n (Step 418). If the hand-shake succeeds, the data packets are forwarded to and from the host server 11 (or the address on the local network 14) by the defensive firewall/router 10 (Step 420) with appropriate header translations. Otherwise, the defensive firewall/router 10 sends a reset to the host sever 11 , (or the address on the local network), and external server 13a- 13n and clears its pending connection state.
[0029] Using the method 400 of the present invention, the need to increase the capacity of SYN ACK queue is greatly reduced. Since the host server 11 or address on the local network 14 never receives a SYN packet until a TCP hand-shake is established, the concern regarding flooding the host server 11 or the address on the local network with SYN packets and the resulting attempts to respond thereto disappear.
[0030] Although the invention has been described in part by making detailed reference to the preferred embodiment, such details are intended to be instructive rather than restrictive. It will be appreciated by those skilled in the art that many variations may be made in the structure and mode of operation without departing from the spirit and scope of the invention as disclosed in the teachings herein.
* * *

Claims

CLAIMS What is claimed is:
1. A method for defending a host, which is coupled to the Internet via a defensive firewall/router, against a denial of service attack, comprising: periodically determining the status of the host; storing the status of the host; receiving at the defensive firewall/router a request from an entity on the Internet for service from the host; and responding to the entity in accordance with said stored status; whereby said period is not related to said request.
2. The method of claim 1 , wherein the host is a host server.
3. The method of claim 1 , wherein the host is an address on a local network.
4. The method of claim 1 , wherein the status includes response rate.
5. The method of claim 1, wherein the status includes error indications.
6. A method for defending a host, which is coupled to the Internet via a defensive firewall/router, against a synchronize/start (SYN) flooding attack, comprising: periodically determining the status of the host; storing the status of the host; receiving a SYN packet from an entity on the Internet; and replying to the external service in accordance with said stored status; whereby if the status is favorable the defensive firewall/router enters a pending connection state.
7. The method of claim 6, further comprising: initiating a timer upon said reply.
8. The method of claim 7, further comprising: determining whether said timer has reached a predetermined limit.
9. The method of claim 8 further comprising: determining whether an error has occurred in response to said reply.
10. The method of claim 9, further comprising: clearing the pending connection state if either an error has occurred or said predetermined limit has been reached.
11. The method of claim 10, further comprising attempting to establish a three-way connection between said defensive firewall/router, said host and said external server.
12. The method of claim 11, further comprising clearing the pending connection state if said attempt fails.
13. The method of claim 11, further comprising sending reset packets from said defensive firewall/router to said host and external server if said attempt fails.
PCT/US2003/022841 2002-07-22 2003-07-22 Denial of service defense by proxy WO2004010259A2 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
AU2003256662A AU2003256662A1 (en) 2002-07-22 2003-07-22 Denial of service defense by proxy
CA002492494A CA2492494A1 (en) 2002-07-22 2003-07-22 Denial of service defense by proxy

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US10/201,244 2002-07-22
US10/201,244 US7162740B2 (en) 2002-07-22 2002-07-22 Denial of service defense by proxy

Publications (2)

Publication Number Publication Date
WO2004010259A2 true WO2004010259A2 (en) 2004-01-29
WO2004010259A3 WO2004010259A3 (en) 2004-04-01

Family

ID=30443613

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2003/022841 WO2004010259A2 (en) 2002-07-22 2003-07-22 Denial of service defense by proxy

Country Status (4)

Country Link
US (2) US7162740B2 (en)
AU (1) AU2003256662A1 (en)
CA (1) CA2492494A1 (en)
WO (1) WO2004010259A2 (en)

Families Citing this family (45)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6789190B1 (en) * 2000-11-16 2004-09-07 Computing Services Support Solutions, Inc. Packet flooding defense system
US7234161B1 (en) * 2002-12-31 2007-06-19 Nvidia Corporation Method and apparatus for deflecting flooding attacks
US7913294B1 (en) 2003-06-24 2011-03-22 Nvidia Corporation Network protocol processing for filtering packets
US7620070B1 (en) 2003-06-24 2009-11-17 Nvidia Corporation Packet processing with re-insertion into network interface circuitry
US7260833B1 (en) * 2003-07-18 2007-08-21 The United States Of America As Represented By The Secretary Of The Navy One-way network transmission interface unit
US7664855B1 (en) * 2004-05-05 2010-02-16 Juniper Networks, Inc. Port scanning mitigation within a network through establishment of an a prior network connection
US7391725B2 (en) 2004-05-18 2008-06-24 Christian Huitema System and method for defeating SYN attacks
FR2872980A1 (en) * 2004-07-08 2006-01-13 France Telecom METHOD, DEVICE AND SYSTEM FOR PROTECTING A SERVER AGAINST SERVICE DENI ATTACKS
US8312530B2 (en) * 2004-07-12 2012-11-13 Cisco Technology, Inc. System and method for providing security in a network environment using accounting information
CN100459611C (en) * 2004-08-06 2009-02-04 华为技术有限公司 Safety management method for hyper text transport protocol service
US7546635B1 (en) 2004-08-11 2009-06-09 Juniper Networks, Inc. Stateful firewall protection for control plane traffic within a network device
US20060075142A1 (en) * 2004-09-29 2006-04-06 Linden Cornett Storing packet headers
US7512684B2 (en) * 2004-09-30 2009-03-31 Intel Corporation Flow based packet processing
US7620046B2 (en) * 2004-09-30 2009-11-17 Intel Corporation Dynamically assigning packet flows
US8090845B2 (en) * 2004-10-18 2012-01-03 Audiocodes Texas, Inc. Apparatus and method for firewall traversal
US7440453B2 (en) * 2004-11-12 2008-10-21 International Business Machines Corporation Determining availability of a destination for computer network communications
US20060126640A1 (en) * 2004-12-14 2006-06-15 Sood Sanjeev H High performance Transmission Control Protocol (TCP) SYN queue implementation
US20070016685A1 (en) * 2005-07-13 2007-01-18 International Business Machines Corporation Buffer overflow proxy
US7650406B2 (en) * 2006-04-26 2010-01-19 Microsoft Corporation Termination of a security association between devices
US8661160B2 (en) * 2006-08-30 2014-02-25 Intel Corporation Bidirectional receive side scaling
US8353030B2 (en) * 2006-12-13 2013-01-08 Avaya Inc. Maintaining communication between network nodes that are subjected to a packet attack
US20080196104A1 (en) * 2007-02-09 2008-08-14 George Tuvell Off-line mms malware scanning system and method
US8310923B1 (en) 2007-03-27 2012-11-13 Amazon Technologies, Inc. Monitoring a network site to detect adverse network conditions
US20080240140A1 (en) * 2007-03-29 2008-10-02 Microsoft Corporation Network interface with receive classification
US8339959B1 (en) 2008-05-20 2012-12-25 Juniper Networks, Inc. Streamlined packet forwarding using dynamic filters for routing and security in a shared forwarding plane
US8014282B2 (en) * 2008-06-26 2011-09-06 Intel Corporation Hashing packet contents to determine a processor
US8955107B2 (en) * 2008-09-12 2015-02-10 Juniper Networks, Inc. Hierarchical application of security services within a computer network
US8375435B2 (en) * 2008-12-19 2013-02-12 International Business Machines Corporation Host trust report based filtering mechanism in a reverse firewall
US8914878B2 (en) 2009-04-29 2014-12-16 Juniper Networks, Inc. Detecting malicious network software agents
US8789173B2 (en) * 2009-09-03 2014-07-22 Juniper Networks, Inc. Protecting against distributed network flood attacks
DE202009014886U1 (en) * 2009-12-18 2010-05-12 Kamax-Werke Rudolf Kellermann Gmbh & Co. Kg ball pin
EP2438511B1 (en) 2010-03-22 2019-07-03 LRDC Systems, LLC A method of identifying and protecting the integrity of a set of source data
US20130007252A1 (en) * 2010-03-31 2013-01-03 Annikki Welin Operations, administrations and management proxy and a method for handling operations, administrations and management messages
US9251535B1 (en) 2012-01-05 2016-02-02 Juniper Networks, Inc. Offload of data transfer statistics from a mobile access gateway
US8613089B1 (en) 2012-08-07 2013-12-17 Cloudflare, Inc. Identifying a denial-of-service attack in a cloud-based proxy service
US9047417B2 (en) 2012-10-29 2015-06-02 Intel Corporation NUMA aware network interface
US8973143B2 (en) 2013-01-28 2015-03-03 The Barrier Group, Llc Method and system for defeating denial of service attacks
US10684973B2 (en) 2013-08-30 2020-06-16 Intel Corporation NUMA node peripheral switch
US9148440B2 (en) 2013-11-25 2015-09-29 Imperva, Inc. Coordinated detection and differentiation of denial of service attacks
WO2018004600A1 (en) 2016-06-30 2018-01-04 Sophos Limited Proactive network security using a health heartbeat
US10972431B2 (en) 2018-04-04 2021-04-06 Sophos Limited Device management based on groups of network adapters
US11271950B2 (en) 2018-04-04 2022-03-08 Sophos Limited Securing endpoints in a heterogenous enterprise network
US11616758B2 (en) * 2018-04-04 2023-03-28 Sophos Limited Network device for securing endpoints in a heterogeneous enterprise network
US11140195B2 (en) 2018-04-04 2021-10-05 Sophos Limited Secure endpoint in a heterogenous enterprise network
CN110830453A (en) * 2019-10-21 2020-02-21 新华三信息安全技术有限公司 Attack processing method and device, electronic equipment and computer readable storage medium

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020002686A1 (en) * 2000-04-17 2002-01-03 Mark Vange Method and system for overcoming denial of service attacks
US20020103916A1 (en) * 2000-09-07 2002-08-01 Benjie Chen Thwarting connection-based denial of service attacks

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5826014A (en) * 1996-02-06 1998-10-20 Network Engineering Software Firewall system for protecting network elements connected to a public network
US6088804A (en) * 1998-01-12 2000-07-11 Motorola, Inc. Adaptive system and method for responding to computer network security attacks
US6226684B1 (en) * 1998-10-26 2001-05-01 Pointcast, Inc. Method and apparatus for reestablishing network connections in a multi-router network
US6977937B1 (en) * 2000-04-10 2005-12-20 Bbnt Solutions Llc Radio network routing apparatus
US6587600B1 (en) * 2000-08-15 2003-07-01 Floor Corporation Methods and apparatus for producing topocompositional images
US7389358B1 (en) * 2000-09-13 2008-06-17 Fortinet, Inc. Distributed virtual system to support managed, network-based services
US7792948B2 (en) * 2001-03-30 2010-09-07 Bmc Software, Inc. Method and system for collecting, aggregating and viewing performance data on a site-wide basis

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020002686A1 (en) * 2000-04-17 2002-01-03 Mark Vange Method and system for overcoming denial of service attacks
US20020103916A1 (en) * 2000-09-07 2002-08-01 Benjie Chen Thwarting connection-based denial of service attacks

Also Published As

Publication number Publication date
CA2492494A1 (en) 2004-01-29
WO2004010259A3 (en) 2004-04-01
AU2003256662A8 (en) 2004-02-09
US7162740B2 (en) 2007-01-09
AU2003256662A1 (en) 2004-02-09
US20040015721A1 (en) 2004-01-22
US7571479B2 (en) 2009-08-04
US20070180511A1 (en) 2007-08-02

Similar Documents

Publication Publication Date Title
US7162740B2 (en) Denial of service defense by proxy
US7234161B1 (en) Method and apparatus for deflecting flooding attacks
US6816910B1 (en) Method and apparatus for limiting network connection resources
Burch Tracing anonymous packets to their approximate source
US11025667B2 (en) System and method for applying a plurality of interconnected filters to protect a computing device from a distributed denial-of-service attack
US7940757B2 (en) Systems and methods for access port ICMP analysis
US7266754B2 (en) Detecting network denial of service attacks
US8397284B2 (en) Detection of distributed denial of service attacks in autonomous system domains
US6973040B1 (en) Method of maintaining lists of network characteristics
US6725378B1 (en) Network protection for denial of service attacks
US20060191003A1 (en) Method of improving security performance in stateful inspection of TCP connections
US20020101819A1 (en) Prevention of bandwidth congestion in a denial of service or other internet-based attack
US20120227088A1 (en) Method for authenticating communication traffic, communication system and protective apparatus
AU2006213541B2 (en) Method, apparatus and computer program product enabling negotiation of firewall features by endpoints
US8387144B2 (en) Network amplification attack mitigation
CN110266678B (en) Security attack detection method and device, computer equipment and storage medium
CN111212096B (en) Method, device, storage medium and computer for reducing IDC defense cost
US7404210B2 (en) Method and apparatus for defending against distributed denial of service attacks on TCP servers by TCP stateless hogs
CN110365658B (en) Reflection attack protection and flow cleaning method, device, equipment and medium
CN110213224B (en) Data packet asynchronous forwarding method and system, data processing system and consensus node terminal
Arafat et al. A practical approach and mitigation techniques on application layer DDoS attack in web server
KR101263381B1 (en) Method and apparatus for defending against denial of service attack in tcp/ip networks
US7565694B2 (en) Method and apparatus for preventing network reset attacks
Dulik Network attack using TCP protocol for performing DoS and DDoS attacks
Al-Duwairi et al. Distributed packet pairing for reflector based DDoS attack mitigation

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A2

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A2

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 2492494

Country of ref document: CA

122 Ep: pct application non-entry in european phase
NENP Non-entry into the national phase

Ref country code: JP

WWW Wipo information: withdrawn in national office

Country of ref document: JP