Patent ID: 9232027
Filing Date: 2016-01-05
CPC Classification: H04L

Claim Text:
1. A computer implemented method for handling transport control protocol connections, the method comprising: receiving by a first host, via a network, a first transport control protocol (TCP) socket connection request from a second host; subtracting, by the first host, a first current port connections from a maximum port connections to form a first difference; calculating a threshold based on the first difference divided by a tunable divisor, the tunable divisor not equal to one; determining whether the first current port connections exceeds the threshold; responsive to a determination that the first current port connections exceeds the threshold, blocking the first transport control protocol socket connection request based on the first TCP socket connection request; responsive to blocking the first TCP socket connection request, logging a blocked TCP socket connection; determining whether a number of logged blocked TCP socket connections exceed an attacker threshold during a ramp-up period; responsive to a determination that the number of logged blocked TCP socket connections exceed an attacker threshold during a ramp-up period, incrementing the tunable divisor; logging an absence of a blocked TCP socket connection during a cool-off period; responsive to logging absence of the blocked TCP socket connection during the cool-off period, decrementing the tunable divisor by multiplying the tunable divisor by a number between 0 and 1; recalculating the threshold based on a second current port connections subtracted from the maximum port connections, to form a second difference, dividing the second difference by the tunable divisor; determining that the second current port connections do not exceed the threshold, and in response, allowing a second TCP socket connection request to form a connection to the second host, wherein the threshold is made larger than the threshold prior to recalculating.