Systems and methods for detecting and preventing flooding attacks in a network environment

摘要

A method for processing network traffic data includes receiving a packet, and determining whether the packet is a previously dropped packet that is being retransmitted. A method for processing network traffic content includes receiving a plurality of headers, the plurality of headers having respective first field values, and determining whether the first field values of the respective headers form a first prescribed pattern. A method for processing network traffic content includes receiving a plurality of packets, and determining an existence of a flooding attack without tracking each of the plurality of packets with a SYN bit.

主权项

1. A method for processing network traffic data comprising:
receiving a packet to initiate a new session from an Internet Protocol (IP) address; determining a concurrent session counter N for active concurrent sessions associated with the IP address; comparing the concurrent session counter N for active concurrent sessions associated with the IP address with a prescribed concurrent session threshold T; allowing the packet to pass when the concurrent session counter N for active concurrent sessions associated with the IP address is less than the prescribed concurrent session threshold T (N=T).